CVE-2026-1879

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1879", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-02-04T07:49:19.915Z", "datePublished": "2026-04-01T10:00:10.991Z", "dateUpdated": "2026-04-01T13:08:49.098Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-01T10:00:10.991Z"}, "title": "Harvard University IQSS Dataverse Theme Customization ThemeAndWidgets.xhtml unrestricted upload", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-434", "lang": "en", "description": "Unrestricted Upload"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-284", "lang": "en", "description": "Improper Access Controls"}]}], "affected": [{"vendor": "Harvard University", "product": "IQSS Dataverse", "versions": [{"version": "6.0", "status": "affected"}, {"version": "6.1", "status": "affected"}, {"version": "6.2", "status": "affected"}, {"version": "6.3", "status": "affected"}, {"version": "6.4", "status": "affected"}, {"version": "6.5", "status": "affected"}, {"version": "6.6", "status": "affected"}, {"version": "6.7", "status": "affected"}, {"version": "6.8", "status": "affected"}, {"version": "6.10", "status": "unaffected"}], "modules": ["Theme Customization"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in Harvard University IQSS Dataverse up to 6.8. This affects an unknown function of the file /ThemeAndWidgets.xhtml of the component Theme Customization. Performing a manipulation of the argument uploadLogo results in unrestricted upload. Remote exploitation of the attack is possible. The exploit is now public and may be used. Upgrading to version 6.10 mitigates this issue. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C"}}], "timeline": [{"time": "2026-04-01T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-04-01T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-04-01T11:22:07.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "JustF0rFun (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/354616", "name": "VDB-354616 | Harvard University IQSS Dataverse Theme Customization ThemeAndWidgets.xhtml unrestricted upload", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/354616/cti", "name": "VDB-354616 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/749003", "name": "Submit #749003 | Harvard University Dataverse Project 6.8 build 1994-92d1ec8 Unrestricted Upload", "tags": ["third-party-advisory"]}, {"url": "https://gist.github.com/KaiqueFerreiraPeres/ba039887d7f894a7c38252314e0ef2cc", "tags": ["exploit"]}, {"url": "https://github.com/IQSS/dataverse/releases/tag/v6.10", "tags": ["patch"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-01T13:08:37.370000Z", "id": "CVE-2026-1879", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-01T13:08:49.098Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1879", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-01T13:08:37.370000Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-01T13:08:45.479Z"}}], "cna": {"title": "Harvard University IQSS Dataverse Theme Customization ThemeAndWidgets.xhtml unrestricted upload", "credits": [{"lang": "en", "type": "reporter", "value": "JustF0rFun (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C"}}], "affected": [{"vendor": "Harvard University", "modules": ["Theme Customization"], "product": "IQSS Dataverse", "versions": [{"status": "affected", "version": "6.0"}, {"status": "affected", "version": "6.1"}, {"status": "affected", "version": "6.2"}, {"status": "affected", "version": "6.3"}, {"status": "affected", "version": "6.4"}, {"status": "affected", "version": "6.5"}, {"status": "affected", "version": "6.6"}, {"status": "affected", "version": "6.7"}, {"status": "affected", "version": "6.8"}, {"status": "unaffected", "version": "6.10"}]}], "timeline": [{"lang": "en", "time": "2026-04-01T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-04-01T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-04-01T11:22:07.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/354616", "name": "VDB-354616 | Harvard University IQSS Dataverse Theme Customization ThemeAndWidgets.xhtml unrestricted upload", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/354616/cti", "name": "VDB-354616 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/749003", "name": "Submit #749003 | Harvard University Dataverse Project 6.8 build 1994-92d1ec8 Unrestricted Upload", "tags": ["third-party-advisory"]}, {"url": "https://gist.github.com/KaiqueFerreiraPeres/ba039887d7f894a7c38252314e0ef2cc", "tags": ["exploit"]}, {"url": "https://github.com/IQSS/dataverse/releases/tag/v6.10", "tags": ["patch"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in Harvard University IQSS Dataverse up to 6.8. This affects an unknown function of the file /ThemeAndWidgets.xhtml of the component Theme Customization. Performing a manipulation of the argument uploadLogo results in unrestricted upload. Remote exploitation of the attack is possible. The exploit is now public and may be used. Upgrading to version 6.10 mitigates this issue. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "Unrestricted Upload"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "Improper Access Controls"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-01T10:00:10.991Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1879", "state": "PUBLISHED", "dateUpdated": "2026-04-01T13:08:49.098Z", "dateReserved": "2026-02-04T07:49:19.915Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-04-01T10:00:10.991Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"modules": ["Theme Customization"], "product": "IQSS Dataverse", "vendor": "Harvard University", "versions": [{"status": "affected", "version": "6.0"}, {"status": "affected", "version": "6.1"}, {"status": "affected", "version": "6.2"}, {"status": "affected", "version": "6.3"}, {"status": "affected", "version": "6.4"}, {"status": "affected", "version": "6.5"}, {"status": "affected", "version": "6.6"}, {"status": "affected", "version": "6.7"}, {"status": "affected", "version": "6.8"}, {"status": "unaffected", "version": "6.10"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in Harvard University IQSS Dataverse up to 6.8. This affects an unknown function of the file /ThemeAndWidgets.xhtml of the component Theme Customization. Performing a manipulation of the argument uploadLogo results in unrestricted upload. Remote exploitation of the attack is possible. The exploit is now public and may be used. Upgrading to version 6.10 mitigates this issue. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product."}, {"lang": "es", "value": "Se detect\u00f3 una vulnerabilidad en Harvard University IQSS Dataverse hasta la versi\u00f3n 6.8. Esto afecta una funci\u00f3n desconocida del archivo /ThemeAndWidgets.xhtml del componente Theme Customization. Realizar una manipulaci\u00f3n del argumento uploadLogo resulta en una carga sin restricciones. La explotaci\u00f3n remota del ataque es posible. El exploit ahora es p\u00fablico y puede ser utilizado. La actualizaci\u00f3n a la versi\u00f3n 6.10 mitiga este problema. Deber\u00eda actualizar el componente afectado. Se contact\u00f3 al proveedor temprano, respondi\u00f3 de manera muy profesional y r\u00e1pidamente lanz\u00f3 una versi\u00f3n corregida del producto afectado."}], "id": "CVE-2026-1879", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1879", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-01T13:08:37.370000Z", "version": "2.0.3"}}]}, "published": "2026-04-01T10:16:15.490", "references": [{"source": "cna@vuldb.com", "url": "https://gist.github.com/KaiqueFerreiraPeres/ba039887d7f894a7c38252314e0ef2cc"}, {"source": "cna@vuldb.com", "url": "https://github.com/IQSS/dataverse/releases/tag/v6.10"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/749003"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/354616"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/354616/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}, {"lang": "en", "value": "CWE-434"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.6"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.7"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.8"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "6.10"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "IQSS Dataverse", "source": "cna", "vendor": "Harvard University"}, "product": "iqss_dataverse", "vendor": "harvard_university"}], "analysis": {"en": {"generated_at": "2026-04-01T12:20:27.481674+00:00", "value": {"mitigation_remediation": ["Apply the vendor's patch by upgrading Harvard University IQSS Dataverse to version 6.10 or later.", "If a gradual transition is required, temporarily disable the Theme Customization feature or restrict access to the /ThemeAndWidgets.xhtml page until the upgrade can be performed.", "Monitor application logs for attempts to upload files via the uploadLogo parameter and investigate any suspicious activity."], "summary": {"action": "Patch", "impact": "Unrestricted File Upload"}, "threat_synthesis": {"affected_systems": "Harvard University IQSS Dataverse versions up to 6.8 are affected, as the flaw was identified in those releases. The vendor released Dataverse 6.10, which removes the unrestricted upload capability from the Theme Customization feature. No other products or components were noted as impacted.", "description_and_impact": "An improper access control flaw within the /ThemeAndWidgets.xhtml page of the Dataverse Theme Customization component permits an attacker to manipulate the uploadLogo parameter and upload files without any restriction on type, size, or location. The weakness aligns with CWE\u2011284 and CWE\u2011434. By uploading a malicious script or binary, an attacker may host arbitrary code on the server, potentially enabling further compromise if the uploaded file is executed or accessed by privileged users.", "risk_and_exploitability": "The CVSS score of 5.3 indicates a moderate severity. The vulnerability can be exploited remotely via a web request to the /ThemeAndWidgets.xhtml endpoint, likely by unauthenticated users, as the advisory does not reference authentication requirements. Publicly available exploits confirm that attackers can reach the upload functionality over the network without credentials. EPSS data is not available, and the issue is not listed in the CISA KEV catalog, but the existence of a public exploit and the lack of upload restrictions elevate the risk for systems that rely on the Theme Customization feature."}}}}, "created": "2026-04-02T07:49:23.084471+00:00", "updated": "2026-04-02T20:17:45.679627+00:00", "vendors": ["harvard_university", "harvard_university$PRODUCT$iqss_dataverse"]}