CVE-2026-120428
PandaWiki 3.65.0 through 3.87.5 contains a stored cross-site scripting vulnerability that allows…
- Risk score
- 42/100
- CVSS
- 6.1 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 2 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- PandaWiki 3.65.0 through 3.87.5 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to upload HTML files with image extensions via /share/v1/common/file/upload. Attackers can lure administrators to /static-file/<key>?a=.pdf, bypassing the nginx attachment header to serve HTML inl…
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.1 medium
References
- https://github.com/chaitin/PandaWiki/blob/v3.87.5/backend/handler/share/common.go
- https://github.com/chaitin/PandaWiki/blob/v3.87.5/backend/usecase/file.go
- https://github.com/chaitin/PandaWiki/blob/v3.87.5/web/admin/server.conf
- https://github.com/chaitin/PandaWiki/issues/1845
- https://vul.yulun.ac.cn/20261101/pandawiki/
- https://www.vulncheck.com/advisories/pandawiki-3.65.0-through-3.87.5-stored-xss-via-static-file-pdf-query-string-bypass
Original description
PandaWiki 3.65.0 through 3.87.5 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to upload HTML files with image extensions via /share/v1/common/file/upload. Attackers can lure administrators to /static-file/<key>?a=.pdf, bypassing the nginx attachment header to serve HTML inline and steal the panda_wiki_token JWT for session takeover.
Last activity 2 Nov 2026. Patch Forecast updates every hour.