---
id: "CVE-2026-129140"
page: "https://infrastack.ai/live/CVE-2026-129140"
kind: "vulnerability"
aliases: ["CVE-2026-129140"]
title: "paicoding: SVG image upload enables stored cross-site scripting attacks"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["java", "package", "paicoding", "self-hosted"]
not_affected_if: ["external-object-storage", "managed-hosting", "no-user-uploads"]
published_at: "2026-11-13T18:17:38+00:00"
first_seen_at: "2026-11-13T18:49:29+00:00"
updated_at: "2026-11-13T18:51:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-129140", "first_seen_at": "2026-11-13T18:49:29+00:00"}]
exploit_sources: []
---

# paicoding: SVG image upload enables stored cross-site scripting attacks

Link for people: https://infrastack.ai/live/CVE-2026-129140 (this .md is for agents)

paicoding 1.0.0 through 1.0.3 accepts SVG files in its image upload and serves them from the site's own origin when local storage is used. An logged-in attacker can upload an SVG containing script, which runs in a victim's browser and can steal the non-HttpOnly f-session cookie to take over accounts.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the paicoding version in the project's dependency or build file; affected versions are `1.0.0` through `1.0.3`.
- Check whether image uploads use local storage (the path where SVG files are served from the site origin).
- Check whether `ImageServiceImpl.validateStaticImg` allows SVG files.

## Timeline

- 2026-11-13T18:49:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-129140

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/paicoding-1.0.0-through-1.0.3-stored-xss-via-svg-image-upload

## From the sources

paicoding 1.0.0 through 1.0.3 contains a stored cross-site scripting vulnerability in image upload because ImageServiceImpl.validateStaticImg accepts SVG files, which are then served from the site origin when local storage is used. Authenticated attackers can upload script-bearing SVG images that execute when victims view them, stealing the non-HttpOnly f-session cookie to hijack accounts.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_