OPENREMOTE · CVE-2026-124435 · Other
NO FIX YET · SEE WHAT TO DO
OpenRemote before 1.32.2 serves uploaded HTML or SVG files from its image endpoint as text/html or image/svg+xml without authentication. A user with write:admin permission can plant JavaScript that runs in the application's origin when a victim opens the link.
first public Oct 23, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running self-hosted OpenRemote Manager below 1.32.2 are exposed, and the risk is greatest where many people hold write:admin rights. Exploitation needs an authenticated admin-level account, and a victim must open a crafted link. Instances already on 1.32.2 or later are not affected.
Not affected if no-write-admin-users, version-1.32.2-or-later
Who cares iot, openremote, self-hosted
1.32.21.32.2 or laterOpenRemote before 1.32.2 contains a stored cross-site scripting vulnerability that allows authenticated users with write:admin permissions to upload HTML or SVG files containing JavaScript via the Manager configuration file upload endpoint. Attackers can lure victims to the unauthenticated image retrieval endpoint, which serves files as text/html or image/svg+xml, executing scripts within the application's origin.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.