CVE-2026-28274

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-28274", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-26T01:52:58.734Z", "datePublished": "2026-02-26T22:55:01.751Z", "dateUpdated": "2026-02-27T17:48:34.045Z"}, "containers": {"cna": {"title": "Initiative Vulnerable to Token Theft via Stored XSS in Document Uploads", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-434", "lang": "en", "description": "CWE-434: Unrestricted Upload of File with Dangerous Type", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/Morelitea/initiative/security/advisories/GHSA-v38c-x27x-p584", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Morelitea/initiative/security/advisories/GHSA-v38c-x27x-p584"}, {"name": "https://github.com/Morelitea/initiative/releases/tag/v0.32.4", "tags": ["x_refsource_MISC"], "url": "https://github.com/Morelitea/initiative/releases/tag/v0.32.4"}], "affected": [{"vendor": "Morelitea", "product": "initiative", "versions": [{"version": "< 0.32.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-26T22:55:01.751Z"}, "descriptions": [{"lang": "en", "value": "Initiative is a self-hosted project management platform. Versions of the application prior to 0.32.4 are vulnerable to Stored Cross-Site Scripting (XSS) in the document upload functionality. Any user with upload permissions within the \"Initiatives\" section can upload a malicious `.html` or `.htm` file as a document. Because the uploaded HTML file is served under the application's origin without proper sandboxing, the embedded JavaScript executes in the context of the application. As a result, authentication tokens, session cookies, or other sensitive data can be exfiltrated to an attacker-controlled server. Additionally, since the uploaded file is hosted under the application's domain, simply sharing the direct file link may result in execution of the malicious script when accessed. Version 0.32.4 fixes the issue."}], "source": {"advisory": "GHSA-v38c-x27x-p584", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-27T17:47:00.683761Z", "id": "CVE-2026-28274", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-27T17:48:34.045Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-28274", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-27T17:47:00.683761Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-27T17:48:19.135Z"}}], "cna": {"title": "Initiative Vulnerable to Token Theft via Stored XSS in Document Uploads", "source": {"advisory": "GHSA-v38c-x27x-p584", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Morelitea", "product": "initiative", "versions": [{"status": "affected", "version": "< 0.32.4"}]}], "references": [{"url": "https://github.com/Morelitea/initiative/security/advisories/GHSA-v38c-x27x-p584", "name": "https://github.com/Morelitea/initiative/security/advisories/GHSA-v38c-x27x-p584", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/Morelitea/initiative/releases/tag/v0.32.4", "name": "https://github.com/Morelitea/initiative/releases/tag/v0.32.4", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Initiative is a self-hosted project management platform. Versions of the application prior to 0.32.4 are vulnerable to Stored Cross-Site Scripting (XSS) in the document upload functionality. Any user with upload permissions within the \"Initiatives\" section can upload a malicious `.html` or `.htm` file as a document. Because the uploaded HTML file is served under the application's origin without proper sandboxing, the embedded JavaScript executes in the context of the application. As a result, authentication tokens, session cookies, or other sensitive data can be exfiltrated to an attacker-controlled server. Additionally, since the uploaded file is hosted under the application's domain, simply sharing the direct file link may result in execution of the malicious script when accessed. Version 0.32.4 fixes the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "CWE-434: Unrestricted Upload of File with Dangerous Type"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-26T22:55:01.751Z"}}}, "cveMetadata": {"cveId": "CVE-2026-28274", "state": "PUBLISHED", "dateUpdated": "2026-02-27T17:48:34.045Z", "dateReserved": "2026-02-26T01:52:58.734Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-26T22:55:01.751Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "initiative", "vendor": "Morelitea", "versions": [{"status": "affected", "version": "< 0.32.4"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:morelitea:initiative:*:*:*:*:*:*:*:*", "matchCriteriaId": "14E07E5B-5651-4A27-86E2-CE508B70B3B6", "versionEndExcluding": "0.32.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Initiative is a self-hosted project management platform. Versions of the application prior to 0.32.4 are vulnerable to Stored Cross-Site Scripting (XSS) in the document upload functionality. Any user with upload permissions within the \"Initiatives\" section can upload a malicious `.html` or `.htm` file as a document. Because the uploaded HTML file is served under the application's origin without proper sandboxing, the embedded JavaScript executes in the context of the application. As a result, authentication tokens, session cookies, or other sensitive data can be exfiltrated to an attacker-controlled server. Additionally, since the uploaded file is hosted under the application's domain, simply sharing the direct file link may result in execution of the malicious script when accessed. Version 0.32.4 fixes the issue."}, {"lang": "es", "value": "Initiative es una plataforma de gesti\u00f3n de proyectos autohospedada. Las versiones de la aplicaci\u00f3n anteriores a la 0.32.4 son vulnerables a Cross-Site Scripting Almacenado (XSS) en la funcionalidad de carga de documentos. Cualquier usuario con permisos de carga dentro de la secci\u00f3n 'Initiatives' puede cargar un archivo .html o .htm malicioso como documento. Debido a que el archivo HTML cargado se sirve bajo el origen de la aplicaci\u00f3n sin un sandboxing adecuado, el JavaScript incrustado se ejecuta en el contexto de la aplicaci\u00f3n. Como resultado, los tokens de autenticaci\u00f3n, las cookies de sesi\u00f3n u otros datos sensibles pueden ser exfiltrados a un servidor controlado por el atacante. Adem\u00e1s, dado que el archivo cargado est\u00e1 alojado bajo el dominio de la aplicaci\u00f3n, simplemente compartir el enlace directo al archivo puede resultar en la ejecuci\u00f3n del script malicioso al ser accedido. La versi\u00f3n 0.32.4 corrige el problema."}], "id": "CVE-2026-28274", "lastModified": "2026-06-17T10:28:24.827", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 5.8, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-28274", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-27T17:47:00.683761Z", "version": "2.0.3"}}]}, "published": "2026-02-26T23:16:37.073", "references": [{"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/Morelitea/initiative/releases/tag/v0.32.4"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/Morelitea/initiative/security/advisories/GHSA-v38c-x27x-p584"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-434"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.32.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "initiative", "source": "cna", "vendor": "Morelitea"}, "product": "initiative", "vendor": "morelitea"}], "analysis": {"en": {"generated_at": "2026-04-18T17:35:21.639883+00:00", "value": {"mitigation_remediation": ["Upgrade Initiative to version 0.32.4 or later to eliminate the XSS vulnerability.", "Restrict upload permissions for the Initiatives section to trusted users only and block the upload of .html/.htm files until the patch is applied.", "If upgrading is delayed, enforce a strict content security policy and prevent uploaded files from being served under the application\u2019s origin to limit the exposure of stored XSS payloads."], "summary": {"action": "Immediate patch", "impact": "Credential theft"}, "threat_synthesis": {"affected_systems": "Morelitea Initiative is the affected product. All releases earlier than version 0.32.4 are impacted. Users who run the Initiatives section and have upload permissions are at risk.", "description_and_impact": "Initiative, a self\u2011hosted project management platform, is affected by a stored cross\u2011site scripting flaw in its document upload feature. Versions prior to 0.32.4 allow users with upload rights to place a malicious .html or .htm file that the application serves from its own domain. The embedded JavaScript runs in the context of the application, permitting an attacker to capture authentication tokens, session cookies, or other sensitive data and send it to a remote server, thereby achieving credential theft and data exfiltration. Because the file is hosted under the application\u2019s domain, any user who opens a shared link can trigger the same attack, magnifying the potential impact.", "risk_and_exploitability": "The CVSS score of 8.7 indicates high severity. The EPSS score of <1% suggests a low probability of exploitation in the wild, and the vulnerability is not listed in CISA\u2019s KEV catalog. An attacker who can upload documents, such as an insider or a compromised user, can deliver the malicious file. Once a user opens the file, the script executes in their browser session, enabling the attacker to exfiltrate authentication tokens, session cookies, or other sensitive data."}}}}, "created": "2026-02-27T09:03:46.011303+00:00", "updated": "2026-04-18T17:45:06.053634+00:00", "vendors": ["morelitea", "morelitea$PRODUCT$initiative"]}