CVE-2026-129140 · Package
NO FIX YET
paicoding 1.0.0 through 1.0.3 accepts SVG files in its image upload and serves them from the site's own origin when local storage is used. An logged-in attacker can upload an SVG containing script, which runs in a victim's browser and can steal the non-HttpOnly f-session cookie to take over accounts.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running paicoding 1.0.0 through 1.0.3 that let users upload images and store them on local disk. Exposure depends on SVG uploads being accepted and served from the same origin as the login session; deployments using external object storage on a different origin or that do not allow user uploads are likely less exposed. The sources do not state which deployments are safe beyond that.
Not affected if external-object-storage, managed-hosting, no-user-uploads
Who cares java, paicoding, self-hosted
1.0.0 through 1.0.3.ImageServiceImpl.validateStaticImg allows SVG files.No fix yet, per the sources.
paicoding 1.0.0 through 1.0.3 contains a stored cross-site scripting vulnerability in image upload because ImageServiceImpl.validateStaticImg accepts SVG files, which are then served from the site origin when local storage is used. Authenticated attackers can upload script-bearing SVG images that execute when victims view them, stealing the non-HttpOnly f-session cookie to hijack accounts.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.