CVE-2026-126771 · Other
NO FIX YET
OpsTree REMS through 1.0.0 accepts attachments with a spoofed text/html Content-Type, so a file named like test.html.pdf renders as HTML when previewed. An authenticated attacker can run JavaScript in the browsers of other users who open the preview.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running OpsTree REMS through 1.0.0 where users can upload attachments and others preview them. The sources do not say whether a patched release exists. Installations without attachment uploads or without a logged-in user base are less exposed.
Not affected if no-attachment-uploads
Who cares opstree-rems, self-hosted
Unknown from the sources.
No fix yet, per the sources.
OpsTree REMS through 1.0.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject scripts by uploading attachments with spoofed text/html Content-Type. Attackers can upload HTML files named like test.html.pdf that render in the REMS origin via Preview, executing JavaScript in victims' browsers.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.