Live › vulnerability › CVE-2026-116212
Go to dashboardWebasyst Framework through 4.4.0 has a stored cross-site scripting flaw in the Photos app's album settings dialog. A backend user with album edit rights can save a crafted URL that runs JavaScript in administrators' backend sessions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 14:30 UTC. All times on this page are UTC.
Teams running Webasyst Framework 4.4.0 or earlier with the Photos app installed, where some backend users can edit albums. The sources do not name a fixed version. Installations without the Photos app, or where only trusted users can edit albums, are less exposed.
No product ranges from the sources yet.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Webasyst Framework through 4.4.0 contains a stored cross-site scripting vulnerability in the Photos app that allows authenticated backend users to inject JavaScript via the album url parameter. Attackers with album edit rights can save a url value that breaks out of the unescaped attribute in DialogAlbumSettings.html, executing JavaScript in administrators' backend sessions.
This page as .md · .json · in your agent: get_signal("CVE-2026-116212")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.