---
id: "CVE-2026-129172"
page: "https://infrastack.ai/live/CVE-2026-129172"
kind: "vulnerability"
aliases: ["CVE-2026-129172"]
title: "EdgeEver: stored XSS in backup restore endpoint lets a shared link run script"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "EdgeEver", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["edgeever", "notes", "other", "self-hosted"]
not_affected_if: ["no-restore-feature-use", "version-2.13.0-or-later"]
published_at: "2026-11-13T18:17:42+00:00"
first_seen_at: "2026-11-13T18:49:31+00:00"
updated_at: "2026-11-13T18:51:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-129172", "first_seen_at": "2026-11-13T18:49:31+00:00"}]
exploit_sources: []
---

# EdgeEver: stored XSS in backup restore endpoint lets a shared link run script

Link for people: https://infrastack.ai/live/CVE-2026-129172 (this .md is for agents)

EdgeEver versions 1.9.0 before 2.13.0 let an authenticated member upload a restore resource marked as an image but served as text/html, and the endpoint does not check that these agree. A victim who opens the shared public blob link runs the attacker's script in their browser, which can mint a non-expiring API token with read and write access to the victim's notes.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:EdgeEver affected range not listed fixed no fixed version listed

## How to check

- Check the EdgeEver version in use; affected versions are 1.9.0 up to but not including 2.13.0.
- Look for `PUT /api/v1/restores/json/resources/` requests in web server or proxy logs.

## Fix

- EdgeEver: move to `2.13.0` or later (the sources give 2.13.0 as the first fixed version)

## Timeline

- 2026-11-13T18:49:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-129172

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/edgeever-1.9.0-before-2.13.0-stored-xss-via-backup-restore-and-public-shares
- [fix] Patch: github.com https://github.com/tianma-if/edgeever/commit/dc5a55a1c26d6add0e28d95dc0b282c611692e34

## From the sources

EdgeEver 1.9.0 before 2.13.0 contains a stored cross-site scripting vulnerability in the backup restore endpoint PUT /api/v1/restores/json/resources/:id, which accepts a resource kind of image paired with a text/html MIME type without checking consistency. Authenticated members can share the note and send the public blob link to a victim, whose browser executes the script to mint a non-expiring API token granting read and write access to the victim's notes.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_