{"id":"CVE-2026-129140","kind":"vulnerability","aliases":["CVE-2026-129140"],"related":[],"title":"paicoding: SVG image upload enables stored cross-site scripting attacks","description":"paicoding 1.0.0 through 1.0.3 contains a stored cross-site scripting vulnerability in image upload because ImageServiceImpl.validateStaticImg accepts SVG files, which are then served from the site origin when local storage is used. Authenticated attackers can upload script-bearing SVG images that execute when victims view them, stealing the non-HttpOnly f-session cookie to hijack accounts.","summary":"paicoding 1.0.0 through 1.0.3 accepts SVG files in its image upload and serves them from the site's own origin when local storage is used. An logged-in attacker can upload an SVG containing script, which runs in a victim's browser and can steal the non-HttpOnly f-session cookie to take over accounts.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["java","package","paicoding","self-hosted"],"not_affected_if":["external-object-storage","managed-hosting","no-user-uploads"],"how_to_check":"- Check the paicoding version in the project's dependency or build file; affected versions are `1.0.0` through `1.0.3`.\n- Check whether image uploads use local storage (the path where SVG files are served from the site origin).\n- Check whether `ImageServiceImpl.validateStaticImg` allows SVG files.","fix":null,"status":"open","published_at":"2026-11-13T18:17:38+00:00","first_seen_at":"2026-11-13T18:49:29+00:00","triaged_at":"2026-11-13T18:51:57+00:00","updated_at":"2026-11-13T18:51:57+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-13T18:51:57Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"paicoding: SVG image upload enables stored cross-site scripting attacks","impact":"medium","summary":"paicoding 1.0.0 through 1.0.3 accepts SVG files in its image upload and serves them from the site's own origin when local storage is used. An logged-in attacker can upload an SVG containing script, which runs in a victim's browser and can steal the non-HttpOnly f-session cookie to take over accounts.","audience":"businesses","category":"package","nicknames":[],"who_cares":["paicoding","java","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Victims' session cookies are stolen, enabling account takeover.","analyst_note":"Confirm the fixed version and any patch from the vulncheck advisory or the upstream project; the sources do not state a fix.","how_to_check":"- Check the paicoding version in the project's dependency or build file; affected versions are `1.0.0` through `1.0.3`.\n- Check whether image uploads use local storage (the path where SVG files are served from the site origin).\n- Check whether `ImageServiceImpl.validateStaticImg` allows SVG files.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["managed-hosting","external-object-storage","no-user-uploads"],"who_is_affected":"Sites running paicoding 1.0.0 through 1.0.3 that let users upload images and store them on local disk. Exposure depends on SVG uploads being accepted and served from the same origin as the login session; deployments using external object storage on a different origin or that do not allow user uploads are likely less exposed. The sources do not state which deployments are safe beyond that.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000778,"input_tokens":4616,"output_tokens":633,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-129140':14A,17A '-2026':13A,16A '1.0.0':25B,83C '1.0.3':27B,85C 'accept':28B,99C 'account':81B,141C 'attack':11A,53B,116C 'authent':115C 'bear':121C 'browser':66B 'contain':58B,86C 'cooki':77B,138C 'cross':8A,90C 'cross-sit':7A,89C 'cve':12A,15A 'enabl':5A 'execut':125C 'f':75B,136C 'f-session':74B,135C 'file':30B,101C 'hijack':140C 'host':23B 'httpon':73B,134C 'imag':3A,33B,95C,123C 'imageserviceimpl.validatestaticimg':98C 'java':18B 'local':45B,111C 'log':51B 'logged-in':50B 'non':72B,133C 'non-httpon':71B,132C 'origin':43B,109C 'packag':19B 'paicod':1A,20B,24B,82C 'run':61B 'script':10A,59B,92C,120C 'script-bear':119C 'self':22B 'self-host':21B 'serv':36B,105C 'session':76B,137C 'site':9A,40B,91C,108C 'steal':69B,130C 'storag':46B,112C 'store':6A,88C 'svg':2A,29B,57B,100C,122C 'take':79B 'upload':4A,34B,55B,96C,118C 'use':48B,114C 'victim':64B,127C 'view':128C 'vulner':93C","nicknames":[],"mitigations":[],"who_affected":"Sites running paicoding 1.0.0 through 1.0.3 that let users upload images and store them on local disk. Exposure depends on SVG uploads being accepted and served from the same origin as the login session; deployments using external object storage on a different origin or that do not allow user uploads are likely less exposed. The sources do not state which deployments are safe beyond that.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["java","medium","package","paicoding","selfhosted"],"campaign_type":null,"search_a":"'-129140':14A,17A '-2026':13A,16A 'attack':11A 'cross':8A 'cross-sit':7A 'cve':12A,15A 'enabl':5A 'imag':3A 'paicod':1A 'script':10A 'site':9A 'store':6A 'svg':2A 'upload':4A","search_b":"'1.0.0':25B '1.0.3':27B 'accept':28B 'account':81B 'attack':53B 'browser':66B 'contain':58B 'cooki':77B 'f':75B 'f-session':74B 'file':30B 'host':23B 'httpon':73B 'imag':33B 'java':18B 'local':45B 'log':51B 'logged-in':50B 'non':72B 'non-httpon':71B 'origin':43B 'packag':19B 'paicod':20B,24B 'run':61B 'script':59B 'self':22B 'self-host':21B 'serv':36B 'session':76B 'site':40B 'steal':69B 'storag':46B 'svg':29B,57B 'take':79B 'upload':34B,55B 'use':48B 'victim':64B","search_c":"'1.0.0':83C '1.0.3':85C 'accept':99C 'account':141C 'attack':116C 'authent':115C 'bear':121C 'contain':86C 'cooki':138C 'cross':90C 'cross-sit':89C 'execut':125C 'f':136C 'f-session':135C 'file':101C 'hijack':140C 'httpon':134C 'imag':95C,123C 'imageserviceimpl.validatestaticimg':98C 'local':111C 'non':133C 'non-httpon':132C 'origin':109C 'paicod':82C 'script':92C,120C 'script-bear':119C 'serv':105C 'session':137C 'site':91C,108C 'steal':130C 'storag':112C 'store':88C 'svg':100C,122C 'upload':96C,118C 'use':114C 'victim':127C 'view':128C 'vulner':93C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T18:17:38+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129140","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129140","severity":null,"published_at":"2026-11-13T18:17:38+00:00","modified_at":"2026-11-13T18:17:38+00:00","first_seen_at":"2026-11-13T18:49:29+00:00","fetched_at":"2026-11-13T18:49:29+00:00","note":null}],"documents":[{"id":148604,"url":"https://www.vulncheck.com/advisories/paicoding-1.0.0-through-1.0.3-stored-xss-via-svg-image-upload","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}