CVE-2026-25739

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25739", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-05T16:48:00.428Z", "datePublished": "2026-02-19T15:39:32.554Z", "dateUpdated": "2026-02-19T19:49:22.187Z"}, "containers": {"cna": {"title": "Indico affected by Cross-Site-Scripting via material uploads", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/indico/indico/security/advisories/GHSA-jxc4-54g3-j7vp", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/indico/indico/security/advisories/GHSA-jxc4-54g3-j7vp"}, {"name": "https://github.com/indico/indico/releases/tag/v3.3.10", "tags": ["x_refsource_MISC"], "url": "https://github.com/indico/indico/releases/tag/v3.3.10"}], "affected": [{"vendor": "indico", "product": "indico", "versions": [{"version": "< 3.3.10", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-19T15:39:32.554Z"}, "descriptions": [{"lang": "en", "value": "Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Versions prior to 3.3.10 are vulnerable to cross-site scripting when uploading certain file types as materials. Users should upgrade to version 3.3.10 to receive a patch. To apply the fix itself updating is sufficient, but to benefit from the strict Content Security Policy (CSP) Indico now applies by default for file downloads, update the webserver config in case one uses nginx with Indico's `STATIC_FILE_METHOD` set to `xaccelredirect`. For further directions, consult the GitHub Security advisory or Indico setup documentation. Some workarounds are available. Use the webserver config to apply a strict CSP for material download endpoints, and/or only let trustworthy users create content (including material uploads, which speakers can typically do as well) on Indico."}], "source": {"advisory": "GHSA-jxc4-54g3-j7vp", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-19T19:48:55.351930Z", "id": "CVE-2026-25739", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-19T19:49:22.187Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25739", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-19T19:48:55.351930Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-19T19:49:13.896Z"}}], "cna": {"title": "Indico affected by Cross-Site-Scripting via material uploads", "source": {"advisory": "GHSA-jxc4-54g3-j7vp", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "indico", "product": "indico", "versions": [{"status": "affected", "version": "< 3.3.10"}]}], "references": [{"url": "https://github.com/indico/indico/security/advisories/GHSA-jxc4-54g3-j7vp", "name": "https://github.com/indico/indico/security/advisories/GHSA-jxc4-54g3-j7vp", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/indico/indico/releases/tag/v3.3.10", "name": "https://github.com/indico/indico/releases/tag/v3.3.10", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Versions prior to 3.3.10 are vulnerable to cross-site scripting when uploading certain file types as materials. Users should upgrade to version 3.3.10 to receive a patch. To apply the fix itself updating is sufficient, but to benefit from the strict Content Security Policy (CSP) Indico now applies by default for file downloads, update the webserver config in case one uses nginx with Indico's `STATIC_FILE_METHOD` set to `xaccelredirect`. For further directions, consult the GitHub Security advisory or Indico setup documentation. Some workarounds are available. Use the webserver config to apply a strict CSP for material download endpoints, and/or only let trustworthy users create content (including material uploads, which speakers can typically do as well) on Indico."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-19T15:39:32.554Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25739", "state": "PUBLISHED", "dateUpdated": "2026-02-19T19:49:22.187Z", "dateReserved": "2026-02-05T16:48:00.428Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-19T15:39:32.554Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "indico", "vendor": "indico", "versions": [{"status": "affected", "version": "< 3.3.10"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cern:indico:*:*:*:*:*:*:*:*", "matchCriteriaId": "386CCD17-7701-42CD-83A1-FEE910FDBBB3", "versionEndExcluding": "3.3.10", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Versions prior to 3.3.10 are vulnerable to cross-site scripting when uploading certain file types as materials. Users should upgrade to version 3.3.10 to receive a patch. To apply the fix itself updating is sufficient, but to benefit from the strict Content Security Policy (CSP) Indico now applies by default for file downloads, update the webserver config in case one uses nginx with Indico's `STATIC_FILE_METHOD` set to `xaccelredirect`. For further directions, consult the GitHub Security advisory or Indico setup documentation. Some workarounds are available. Use the webserver config to apply a strict CSP for material download endpoints, and/or only let trustworthy users create content (including material uploads, which speakers can typically do as well) on Indico."}, {"lang": "es", "value": "Indico es un sistema de gesti\u00f3n de eventos que utiliza Flask-Multipass, un sistema de autenticaci\u00f3n multi-backend para Flask. Las versiones anteriores a la 3.3.10 son vulnerables a cross-site scripting al subir ciertos tipos de archivos como materiales. Los usuarios deben actualizar a la versi\u00f3n 3.3.10 para recibir un parche. Para aplicar la correcci\u00f3n en s\u00ed, la actualizaci\u00f3n es suficiente, pero para beneficiarse de la estricta Pol\u00edtica de Seguridad de Contenido (CSP) que Indico ahora aplica por defecto para las descargas de archivos, actualice la configuraci\u00f3n del servidor web en caso de que se use nginx con el `STATIC_FILE_METHOD` de Indico configurado como `xaccelredirect`. Para obtener m\u00e1s indicaciones, consulte el aviso de seguridad de GitHub o la documentaci\u00f3n de configuraci\u00f3n de Indico. Algunas soluciones alternativas est\u00e1n disponibles. Utilice la configuraci\u00f3n del servidor web para aplicar una CSP estricta para los puntos finales de descarga de materiales, y/o solo permita que usuarios de confianza creen contenido (incluidas las subidas de materiales, que los ponentes tambi\u00e9n pueden hacer normalmente) en Indico."}], "id": "CVE-2026-25739", "lastModified": "2026-06-17T10:25:08.660", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25739", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-19T19:48:55.351930Z", "version": "2.0.3"}}]}, "published": "2026-02-19T16:27:15.270", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/indico/indico/releases/tag/v3.3.10"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/indico/indico/security/advisories/GHSA-jxc4-54g3-j7vp"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.3.10)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "indico", "source": "cna", "vendor": "indico"}, "product": "indico", "vendor": "indico"}], "analysis": {"en": {"generated_at": "2026-04-18T17:55:13.911739+00:00", "value": {"mitigation_remediation": ["Upgrade Indico to version 3.3.10 or later to apply the XSS fix.", "If your deployment uses nginx with the STATIC_FILE_METHOD set to xaccelredirect, update the web\u2011server configuration to enforce the new strict Content\u2011Security\u2011Policy for material download endpoints.", "Restrict material upload privileges to trusted users such as speakers or administrators."], "summary": {"action": "Patch", "impact": "Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "The affected product is CERN\u2019s Indico event\u2011management system (indico:indico). All releases older than v3.3.10 are impacted. Versions 3.3.10 and newer contain the fix that removes the XSS vector.", "description_and_impact": "Indico, an event\u2011management platform, is affected by a cross\u2011site scripting flaw that occurs when users upload certain file types as materials in versions prior to 3.3.10. The vulnerability permits malicious JavaScript to be injected into the page that displays the uploaded material, allowing an attacker to execute code within the context of any user who views the material. The impact is limited to the content displayed to users, and an attacker could alter the appearance of the page or deliver malicious payloads when the script runs in the victim\u2019s browser.", "risk_and_exploitability": "The CVSS score of 5.4 indicates moderate severity, and the EPSS score of less than 1% indicates that the vulnerability is considered unlikely to be widely exploited at this time. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires an authenticated user able to upload a specially crafted material file; after upload any other user who views the material will be exposed to the injected script. Updating to v3.3.10 removes the vulnerability. For deployments that cannot be upgraded immediately, applying the strict Content\u2011Security\u2011Policy for material download endpoints via the web\u2011server configuration (or limiting upload privileges to trusted users) can mitigate the risk."}}}}, "created": "2026-02-20T10:06:27.394502+00:00", "updated": "2026-04-18T18:00:06.463559+00:00", "vendors": ["indico", "indico$PRODUCT$indico"]}