CVE-2026-129267 · Runtime
NO FIX YET
XBackBone, a self-hosted file-sharing and screenshot server, has a cross-site scripting flaw in its MediaController::getRawById function. An attacker who can get a victim to load a crafted link could run scripts in the victim's browser session on the XBackBone site.
first public Nov 14, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
No product ranges from the sources yet.
Not affected if xbackbone-newer-than-3.8.2
Who cares php, self-hosted, xbackbone
3.8.2, which the sources list as affected.app/Controllers/MediaController.php in your install contains the getRawById function.No fix yet, per the sources.
A vulnerability was found in sergix44 XBackBone up to 3.8.2. Impacted is the function MediaController::getRawById of the file app/Controllers/MediaController.php. The manipulation results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.