Live › vulnerability › CVE-2026-120428
PandaWiki 3.65.0 through 3.87.5 accepts unauthenticated uploads of HTML files disguised with image extensions. When an administrator opens a crafted link to the uploaded file, the browser renders it inline and the attacker can read the panda_wiki_token JWT to take over the session.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 15:24 UTC. All times on this page are UTC.
PandaWiki instances in the affected range that accept the public share upload endpoint and serve static files from the same origin as the admin panel. Administrators who browse links to uploaded files are the lure target. Instances on versions outside 3.65.0 through 3.87.5 are not affected by this report.
No product ranges from the sources yet.
3.87.5; the exact fixed version is unknown from the sourcesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
PandaWiki 3.65.0 through 3.87.5 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to upload HTML files with image extensions via /share/v1/common/file/upload. Attackers can lure administrators to /static-file/<key>?a=.pdf, bypassing the nginx attachment header to serve HTML inline and steal the panda_wiki_token JWT for session takeover.
This page as .md · .json · in your agent: get_signal("CVE-2026-120428")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.