CVE-2026-26272

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-26272", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-12T17:10:53.413Z", "datePublished": "2026-03-03T22:20:32.987Z", "dateUpdated": "2026-03-04T16:45:08.580Z"}, "containers": {"cna": {"title": "HomeBox affected by Stored XSS via HTML/SVG Attachment Upload", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-55fv-9q6q-vpcr", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-55fv-9q6q-vpcr"}, {"name": "https://github.com/sysadminsmedia/homebox/commit/51bd04e5f4656b306a296745ddd854d45aa3b892", "tags": ["x_refsource_MISC"], "url": "https://github.com/sysadminsmedia/homebox/commit/51bd04e5f4656b306a296745ddd854d45aa3b892"}], "affected": [{"vendor": "sysadminsmedia", "product": "homebox", "versions": [{"version": "< 0.24.0-rc.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-03T22:20:32.987Z"}, "descriptions": [{"lang": "en", "value": "HomeBox is a home inventory and organization system. Prior to 0.24.0-rc.1, a stored cross-site scripting (XSS) vulnerability exists in the item attachment upload functionality. The application does not properly validate or restrict uploaded file types, allowing an authenticated user to upload malicious HTML or SVG files containing executable JavaScript (also, potentially other formats that render scripts). Uploaded attachments are accessible via direct links. When a user accesses such a file in their browser, the embedded JavaScript executes in the context of the application's origin. This vulnerability is fixed in 0.24.0-rc.1."}], "source": {"advisory": "GHSA-55fv-9q6q-vpcr", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-04T16:44:58.799912Z", "id": "CVE-2026-26272", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-04T16:45:08.580Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-26272", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-04T16:44:58.799912Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-04T16:45:04.560Z"}}], "cna": {"title": "HomeBox affected by Stored XSS via HTML/SVG Attachment Upload", "source": {"advisory": "GHSA-55fv-9q6q-vpcr", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "sysadminsmedia", "product": "homebox", "versions": [{"status": "affected", "version": "< 0.24.0-rc.1"}]}], "references": [{"url": "https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-55fv-9q6q-vpcr", "name": "https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-55fv-9q6q-vpcr", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/sysadminsmedia/homebox/commit/51bd04e5f4656b306a296745ddd854d45aa3b892", "name": "https://github.com/sysadminsmedia/homebox/commit/51bd04e5f4656b306a296745ddd854d45aa3b892", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "HomeBox is a home inventory and organization system. Prior to 0.24.0-rc.1, a stored cross-site scripting (XSS) vulnerability exists in the item attachment upload functionality. The application does not properly validate or restrict uploaded file types, allowing an authenticated user to upload malicious HTML or SVG files containing executable JavaScript (also, potentially other formats that render scripts). Uploaded attachments are accessible via direct links. When a user accesses such a file in their browser, the embedded JavaScript executes in the context of the application's origin. This vulnerability is fixed in 0.24.0-rc.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-03T22:20:32.987Z"}}}, "cveMetadata": {"cveId": "CVE-2026-26272", "state": "PUBLISHED", "dateUpdated": "2026-03-04T16:45:08.580Z", "dateReserved": "2026-02-12T17:10:53.413Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-03T22:20:32.987Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "homebox", "vendor": "sysadminsmedia", "versions": [{"status": "affected", "version": "< 0.24.0-rc.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sysadminsmedia:homebox:*:*:*:*:*:*:*:*", "matchCriteriaId": "16FA5C78-4497-4434-802B-AAA83C1BF0A8", "versionEndIncluding": "0.23.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "HomeBox is a home inventory and organization system. Prior to 0.24.0-rc.1, a stored cross-site scripting (XSS) vulnerability exists in the item attachment upload functionality. The application does not properly validate or restrict uploaded file types, allowing an authenticated user to upload malicious HTML or SVG files containing executable JavaScript (also, potentially other formats that render scripts). Uploaded attachments are accessible via direct links. When a user accesses such a file in their browser, the embedded JavaScript executes in the context of the application's origin. This vulnerability is fixed in 0.24.0-rc.1."}, {"lang": "es", "value": "HomeBox es un sistema de inventario y organizaci\u00f3n del hogar. Antes de la versi\u00f3n 0.24.0-rc.1, existe una vulnerabilidad de cross-site scripting (XSS) almacenado en la funcionalidad de carga de archivos adjuntos de elementos. La aplicaci\u00f3n no valida ni restringe adecuadamente los tipos de archivos cargados, permitiendo a un usuario autenticado cargar archivos HTML o SVG maliciosos que contienen JavaScript ejecutable (tambi\u00e9n, potencialmente otros formatos que renderizan scripts). Los archivos adjuntos cargados son accesibles a trav\u00e9s de enlaces directos. Cuando un usuario accede a dicho archivo en su navegador, el JavaScript incrustado se ejecuta en el contexto del origen de la aplicaci\u00f3n. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 0.24.0-rc.1."}], "id": "CVE-2026-26272", "lastModified": "2026-06-17T10:26:01.377", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-26272", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-04T16:44:58.799912Z", "version": "2.0.3"}}]}, "published": "2026-03-03T23:15:55.050", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/sysadminsmedia/homebox/commit/51bd04e5f4656b306a296745ddd854d45aa3b892"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-55fv-9q6q-vpcr"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.24.0-rc.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "homebox", "source": "cna", "vendor": "sysadminsmedia"}, "product": "homebox", "vendor": "sysadminsmedia"}], "analysis": {"en": {"generated_at": "2026-04-17T13:18:40.122539+00:00", "value": {"mitigation_remediation": ["Upgrade HomeBox to version 0.24.0\u2011rc.1 or later to eliminate the vulnerability.", "If an upgrade is not immediately possible, configure the application to allow only safe file types and enforce strict MIME\u2011type checks on uploaded attachments.", "As a temporary measure, consider disabling the attachment upload feature or blocking HTML and SVG files from being uploaded until a patch can be applied."], "summary": {"action": "Patch Now", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "Sysadminsmedia\u2019s HomeBox software, versions earlier than 0.24.0\u2011rc.1, is affected by this issue. The vulnerability applies to all installations of these versions regardless of operating system, as the flaw is in the web application code.", "description_and_impact": "HomeBox, a home inventory and organization system, contains a stored XSS flaw in its item attachment upload functionality. The application fails to enforce file type validation, which allows an authenticated user to upload malicious HTML or SVG files embedding executable JavaScript. When a victim user opens such an attachment through a direct link, the script runs in the context of the application\u2019s origin, allowing the attacker to steal session data, modify page content, or execute further client\u2011side attacks.", "risk_and_exploitability": "The CVSS base score of 4.6 indicates moderate severity, and the EPSS score of less than 1% suggests a very low but non\u2011zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated user to upload the malicious file, but any user who opens the resulting attachment is exposed to the embedded script, enabling widespread impact across the user base."}}}}, "created": "2026-03-04T14:53:36.331029+00:00", "updated": "2026-04-17T13:30:19.593174+00:00", "vendors": ["sysadminsmedia", "sysadminsmedia$PRODUCT$homebox"]}