CVE-2026-63147
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Omnispace Agora Project < 26.10.0 Stored XSS via Uploaded File Name
Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious script by uploading a file with HTML/script markup embedded in its filename, which bypasses the paramFilter since uploaded-file names arrive through $_FILES rather than $_GET/$_POST. Attackers can upload a file with a crafted name such as an SVG onload payload to have the unsanitized filename stored and later rendered to other users, resulting in script execution in their browsers.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Agora Project
- Vendor
- Omnispace
- Product
- Agora Project
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 0 | affected | semver | 26.10.0 | Unavailable | None listed |