{"id":"CVE-2026-120428","kind":"vulnerability","aliases":["CVE-2026-120428"],"related":[],"title":"PandaWiki: stored XSS lets attackers steal admin session tokens","description":"PandaWiki 3.65.0 through 3.87.5 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to upload HTML files with image extensions via /share/v1/common/file/upload. Attackers can lure administrators to /static-file/<key>?a=.pdf, bypassing the nginx attachment header to serve HTML inline and steal the panda_wiki_token JWT for session takeover.","summary":"PandaWiki 3.65.0 through 3.87.5 accepts unauthenticated uploads of HTML files disguised with image extensions. When an administrator opens a crafted link to the uploaded file, the browser renders it inline and the attacker can read the panda_wiki_token JWT to take over the session.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["nginx","package","pandawiki","self-hosted"],"not_affected_if":["version-outside-range"],"how_to_check":"- Check the installed PandaWiki version against the affected range 3.65.0 through 3.87.5\n- Look for uploaded files with image extensions whose content is HTML under the static-file storage path","fix":"- Move to a PandaWiki release newer than `3.87.5`; the exact fixed version is unknown from the sources","status":"open","published_at":"2026-11-02T15:17:24+00:00","first_seen_at":"2026-11-02T15:24:01+00:00","triaged_at":"2026-11-02T15:26:21+00:00","updated_at":"2026-11-02T15:26:21+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-02T15:26:21Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a PandaWiki release newer than `3.87.5`; the exact fixed version is unknown from the sources","reach":"internet","title":"PandaWiki: stored XSS lets attackers steal admin session tokens","impact":"high","summary":"PandaWiki 3.65.0 through 3.87.5 accepts unauthenticated uploads of HTML files disguised with image extensions. When an administrator opens a crafted link to the uploaded file, the browser renders it inline and the attacker can read the panda_wiki_token JWT to take over the session.","audience":"businesses","category":"package","nicknames":[],"who_cares":["pandawiki","self-hosted","nginx"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker steals admin session token and takes over the wiki","analyst_note":"Confirm the fixed version and whether the upload endpoint is exposed by default; check the NVD and VulnCheck pages for a patched release.","how_to_check":"- Check the installed PandaWiki version against the affected range 3.65.0 through 3.87.5\n- Look for uploaded files with image extensions whose content is HTML under the static-file storage path\n- unknown for other checks","plain_action":"","needs_analyst":true,"not_affected_if":["version-outside-range"],"who_is_affected":"PandaWiki instances in the affected range that accept the public share upload endpoint and serve static files from the same origin as the admin panel. Administrators who browse links to uploaded files are the lure target. Instances on versions outside 3.65.0 through 3.87.5 are not affected by this report.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000719,"input_tokens":4201,"output_tokens":598,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120428':12A,15A '-2026':11A,14A '/share/v1/common/file/upload':91C '/static-file':97C '3.65.0':23B,68C '3.87.5':25B,70C 'accept':26B 'admin':7A 'administr':38B,95C 'allow':80C 'attach':103C 'attack':5A,54B,82C,92C 'browser':48B 'bypass':100C 'contain':71C 'craft':41B 'cross':75C 'cross-sit':74C 'cve':10A,13A 'disguis':32B 'extens':35B,89C 'file':31B,46B,86C 'header':104C 'host':21B 'html':30B,85C,107C 'imag':34B,88C 'inlin':51B,108C 'jwt':61B,115C 'let':4A 'link':42B 'lure':94C 'nginx':16B,102C 'open':39B 'packag':17B 'panda':58B,112C 'pandawiki':1A,18B,22B,67C 'pdf':99C 'read':56B 'render':49B 'script':77C 'self':20B 'self-host':19B 'serv':106C 'session':8A,66B,117C 'site':76C 'steal':6A,110C 'store':2A,73C 'take':63B 'takeov':118C 'token':9A,60B,114C 'unauthent':27B,81C 'upload':28B,45B,84C 'via':90C 'vulner':78C 'wiki':59B,113C 'xss':3A","nicknames":[],"mitigations":[],"who_affected":"PandaWiki instances in the affected range that accept the public share upload endpoint and serve static files from the same origin as the admin panel. Administrators who browse links to uploaded files are the lure target. Instances on versions outside 3.65.0 through 3.87.5 are not affected by this report.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","nginx","package","pandawiki","selfhosted"],"first_public_at":"2026-11-02T15:17:24+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120428","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120428","severity":null,"published_at":"2026-11-02T15:17:24+00:00","modified_at":"2026-11-02T15:17:24+00:00","first_seen_at":"2026-11-02T15:24:01+00:00","fetched_at":"2026-11-02T15:24:01+00:00","note":null}],"documents":[{"id":52446,"url":"https://www.vulncheck.com/advisories/pandawiki-3.65.0-through-3.87.5-stored-xss-via-static-file-pdf-query-string-bypass","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}