Bug 2571815 (CVE-2026-126771)
| Summary: | CVE-2026-126771 rems: rems: Stored cross-site scripting via attachment preview | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | Keywords: | Security |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in REMS. An authenticated remote attacker can exploit a stored Cross-Site Scripting (XSS) vulnerability by uploading a file with a spoofed content type. When another user views or previews the attachment, the application renders the file and executes the malicious script within the victim's browser session. This can allow an attacker to compromise sensitive user data or perform unauthorized actions on behalf of the victim.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2026-11-11 18:21:24 UTC
|