CVE-2026-1466

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1466", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "state": "PUBLISHED", "assignerShortName": "GitLab", "dateReserved": "2026-01-27T08:04:12.765Z", "datePublished": "2026-01-28T06:33:15.181Z", "dateUpdated": "2026-01-28T20:48:25.368Z"}, "containers": {"cna": {"title": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Jirafeau", "descriptions": [{"lang": "en", "value": "Jirafeau normally prevents browser preview for text files due to the possibility that for example SVG and HTML documents could be exploited for cross site scripting. This was done by storing the MIME type of a file and allowing only browser preview for MIME types beginning with image (except for image/svg+xml, see CVE-2022-30110, CVE-2024-12326 and CVE-2025-7066), video and audio. However, it was possible to bypass this check by sending a manipulated HTTP request with an invalid MIME type like image. When doing the preview, the browser tries to automatically detect the MIME type resulting in detecting SVG and possibly executing JavaScript code. To prevent this, MIME sniffing is disabled by sending the HTTP header X-Content-Type-Options: nosniff."}], "affected": [{"vendor": "Jirafeau project", "product": "Jirafeau", "versions": [{"version": "0", "status": "affected", "lessThan": "4.7.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "references": [{"url": "https://gitlab.com/jirafeau/Jirafeau/-/commit/747afb20bfcff14bb67e40e7035d47a6311ba3e1"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2022-30110"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2024-12326"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2025-7066"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM"}}], "solutions": [{"lang": "en", "value": "Upgrade to version 4.7.1"}], "credits": [{"lang": "en", "value": "Yann Cam, Killian Chevrier, Patrick Canterino", "type": "finder"}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2026-01-28T06:33:15.181Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-28T20:48:10.333121Z", "id": "CVE-2026-1466", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-28T20:48:25.368Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1466", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-28T20:48:10.333121Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-28T20:48:14.097Z"}}], "cna": {"title": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Jirafeau", "credits": [{"lang": "en", "type": "finder", "value": "Yann Cam, Killian Chevrier, Patrick Canterino"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Jirafeau project", "product": "Jirafeau", "versions": [{"status": "affected", "version": "0", "lessThan": "4.7.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade to version 4.7.1"}], "references": [{"url": "https://gitlab.com/jirafeau/Jirafeau/-/commit/747afb20bfcff14bb67e40e7035d47a6311ba3e1"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2022-30110"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2024-12326"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2025-7066"}], "descriptions": [{"lang": "en", "value": "Jirafeau normally prevents browser preview for text files due to the possibility that for example SVG and HTML documents could be exploited for cross site scripting. This was done by storing the MIME type of a file and allowing only browser preview for MIME types beginning with image (except for image/svg+xml, see CVE-2022-30110, CVE-2024-12326 and CVE-2025-7066), video and audio. However, it was possible to bypass this check by sending a manipulated HTTP request with an invalid MIME type like image. When doing the preview, the browser tries to automatically detect the MIME type resulting in detecting SVG and possibly executing JavaScript code. To prevent this, MIME sniffing is disabled by sending the HTTP header X-Content-Type-Options: nosniff."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2026-01-28T06:33:15.181Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1466", "state": "PUBLISHED", "dateUpdated": "2026-01-28T20:48:25.368Z", "dateReserved": "2026-01-27T08:04:12.765Z", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "datePublished": "2026-01-28T06:33:15.181Z", "assignerShortName": "GitLab"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Jirafeau", "vendor": "Jirafeau project", "versions": [{"lessThan": "4.7.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "cve@gitlab.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:jirafeau:jirafeau:*:*:*:*:*:*:*:*", "matchCriteriaId": "91A060C5-0315-4252-B822-BDA2D030277B", "versionEndExcluding": "4.7.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Jirafeau normally prevents browser preview for text files due to the possibility that for example SVG and HTML documents could be exploited for cross site scripting. This was done by storing the MIME type of a file and allowing only browser preview for MIME types beginning with image (except for image/svg+xml, see CVE-2022-30110, CVE-2024-12326 and CVE-2025-7066), video and audio. However, it was possible to bypass this check by sending a manipulated HTTP request with an invalid MIME type like image. When doing the preview, the browser tries to automatically detect the MIME type resulting in detecting SVG and possibly executing JavaScript code. To prevent this, MIME sniffing is disabled by sending the HTTP header X-Content-Type-Options: nosniff."}, {"lang": "es", "value": "Jirafeau normalmente impide la previsualizaci\u00f3n del navegador para archivos de texto debido a la posibilidad de que, por ejemplo, documentos SVG y HTML pudieran ser explotados para cross-site scripting. Esto se hac\u00eda almacenando el tipo MIME de un archivo y permitiendo solo la previsualizaci\u00f3n del navegador para tipos MIME que comienzan con 'image' (excepto para 'image/svg+xml', ver CVE-2022-30110, CVE-2024-12326 y CVE-2025-7066), video y audio. Sin embargo, era posible eludir esta comprobaci\u00f3n enviando una solicitud HTTP manipulada con un tipo MIME inv\u00e1lido como 'image'. Al realizar la previsualizaci\u00f3n, el navegador intenta detectar autom\u00e1ticamente el tipo MIME, lo que resulta en la detecci\u00f3n de SVG y posiblemente la ejecuci\u00f3n de c\u00f3digo JavaScript. Para evitar esto, el MIME sniffing est\u00e1 deshabilitado enviando la cabecera HTTP X-Content-Type-Options: nosniff."}], "id": "CVE-2026-1466", "lastModified": "2026-06-17T10:15:50.523", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "cve@gitlab.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1466", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-28T20:48:10.333121Z", "version": "2.0.3"}}]}, "published": "2026-01-28T07:16:01.087", "references": [{"source": "cve@gitlab.com", "tags": ["Patch"], "url": "https://gitlab.com/jirafeau/Jirafeau/-/commit/747afb20bfcff14bb67e40e7035d47a6311ba3e1"}, {"source": "cve@gitlab.com", "tags": ["Not Applicable"], "url": "https://www.cve.org/CVERecord?id=CVE-2022-30110"}, {"source": "cve@gitlab.com", "tags": ["Not Applicable"], "url": "https://www.cve.org/CVERecord?id=CVE-2024-12326"}, {"source": "cve@gitlab.com", "tags": ["Not Applicable"], "url": "https://www.cve.org/CVERecord?id=CVE-2025-7066"}], "sourceIdentifier": "cve@gitlab.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "cve@gitlab.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T01:45:41.336105+00:00", "value": {"mitigation_remediation": ["Upgrade Jirafeau to version 4.7.1 or later", "Configure the web server or application to include the X\u2011Content\u2011Type\u2011Options: nosniff header for all preview responses", "Modify the MIME type validation logic to allow only safe image, video, and audio types, rejecting any others"], "summary": {"action": "Immediate Patch", "impact": "Cross\u2011Site Scripting (XSS) via manipulated MIME preview"}, "threat_synthesis": {"affected_systems": "The flaw affects the Jirafeau project\u2019s Jirafeau file\u2011sharing application. All installations running a version prior to 4.7.1 are vulnerable. The vendor recommends upgrading to version 4.7.1, which removes the bypass that permits the invalid MIME type to trigger the preview.", "description_and_impact": "The vulnerability allows an attacker to inject arbitrary JavaScript into the browser by crafting an HTTP request with an invalid MIME type, causing the preview engine to perform MIME sniffing and treat the content as an SVG that executes embedded scripts. This flaw is an example of improper input neutralization and is identified as CWE\u201179. Successful exploitation permits the attacker to run malicious scripts in the context of the victim\u2019s session, enabling data theft, session hijacking or defacement. The CVSS score of 6.1 indicates moderate severity, but the EPSS score of less than 1% suggests that attacks are currently rare. The issue is not listed in the CISA KEV catalog.", "risk_and_exploitability": "Because the flaw can be triggered through a crafted preview request, an attacker only needs to send the malicious request from any network that can reach the Jirafeau instance. There is no prerequisite of user authentication; the vulnerability could be exploited by a public attacker who can force the browser to display the preview. The low EPSS score implies that, at present, there is little observed exploitation, but the moderate CVSS score and the nature of XSS recommend immediate response. No marketplace exploitation has been reported, but the flaw does not appear in KEV, meaning there is currently no known large\u2011scale exploitation campaign."}}}}, "created": "2026-01-29T09:18:14.145140+00:00", "updated": "2026-04-18T02:00:10.456840+00:00", "vendors": ["jirafeau", "jirafeau$PRODUCT$jirafeau"]}