{"id":"CVE-2026-129267","kind":"vulnerability","aliases":["CVE-2026-129267"],"related":[],"title":"XBackBone: flaw in raw media endpoint enables cross-site scripting","description":"A vulnerability was found in sergix44 XBackBone up to 3.8.2. Impacted is the function MediaController::getRawById of the file app/Controllers/MediaController.php. The manipulation results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance.","summary":"XBackBone, a self-hosted file-sharing and screenshot server, has a cross-site scripting flaw in its MediaController::getRawById function. An attacker who can get a victim to load a crafted link could run scripts in the victim's browser session on the XBackBone site.","severity":"medium","cvss":4.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["php","runtime","self-hosted","xbackbone"],"not_affected_if":["xbackbone-newer-than-3.8.2"],"how_to_check":"- Look at the installed XBackBone version and compare it with `3.8.2`, which the sources list as affected.\n- Check whether `app/Controllers/MediaController.php` in your install contains the `getRawById` function.","fix":null,"status":"open","published_at":"2026-11-14T18:17:20+00:00","first_seen_at":"2026-11-14T18:31:01+00:00","triaged_at":"2026-11-14T18:32:00+00:00","updated_at":"2026-11-14T18:32:00+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-14T18:32:00Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"internet","title":"XBackBone: flaw in raw media endpoint enables cross-site scripting","impact":"medium","summary":"XBackBone, a self-hosted file-sharing and screenshot server, has a cross-site scripting flaw in its MediaController::getRawById function. An attacker who can get a victim to load a crafted link could run scripts in the victim's browser session on the XBackBone site.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["xbackbone","php","self-hosted"],"confidence":0.6,"fix_status":"none","needs_auth":"unknown","worst_case":"scripts run in users' browser sessions on the server","analyst_note":"Confirm whether a fixed XBackBone release exists beyond 3.8.2; the only source is NVD and the fix is a pending pull request.","how_to_check":"- Look at the installed XBackBone version and compare it with `3.8.2`, which the sources list as affected.\n- Check whether `app/Controllers/MediaController.php` in your install contains the `getRawById` function.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["xbackbone-newer-than-3.8.2"],"who_is_affected":"unknown","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000692,"input_tokens":4563,"output_tokens":472,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-129267':14A,17A '-2026':13A,16A '3.8.2':81C 'accept':125C 'app/controllers/mediacontroller.php':91C 'attack':48B,105C 'await':124C 'browser':66B 'could':59B,114C 'craft':57B 'cross':9A,38B,96C 'cross-sit':8A,37B 'cve':12A,15A 'enabl':7A 'endpoint':6A 'exploit':108C 'file':30B,90C 'file-shar':29B 'fix':121C 'flaw':2A,41B 'found':75C 'function':46B,85C 'get':51B 'getrawbyid':45B,87C 'host':22B,28B 'impact':82C 'issu':123C 'launch':103C 'link':58B 'load':55B 'made':111C 'manipul':93C 'media':5A 'mediacontrol':44B,86C 'php':18B 'possibl':101C 'public':112C 'pull':118C 'raw':4A 'remot':106C 'request':119C 'result':94C 'run':60B 'runtim':19B 'screenshot':33B 'script':11A,40B,61B,98C 'self':21B,27B 'self-host':20B,26B 'sergix44':77C 'server':34B 'session':67B 'share':31B 'site':10A,39B,71B,97C 'use':116C 'victim':53B,64B 'vulner':73C 'xbackbon':1A,23B,24B,70B,78C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","php","runtime","selfhosted","xbackbone"],"campaign_type":null,"search_a":"'-129267':14A,17A '-2026':13A,16A 'cross':9A 'cross-sit':8A 'cve':12A,15A 'enabl':7A 'endpoint':6A 'flaw':2A 'media':5A 'raw':4A 'script':11A 'site':10A 'xbackbon':1A","search_b":"'attack':48B 'browser':66B 'could':59B 'craft':57B 'cross':38B 'cross-sit':37B 'file':30B 'file-shar':29B 'flaw':41B 'function':46B 'get':51B 'getrawbyid':45B 'host':22B,28B 'link':58B 'load':55B 'mediacontrol':44B 'php':18B 'run':60B 'runtim':19B 'screenshot':33B 'script':40B,61B 'self':21B,27B 'self-host':20B,26B 'server':34B 'session':67B 'share':31B 'site':39B,71B 'victim':53B,64B 'xbackbon':23B,24B,70B","search_c":"'3.8.2':81C 'accept':125C 'app/controllers/mediacontroller.php':91C 'attack':105C 'await':124C 'could':114C 'cross':96C 'exploit':108C 'file':90C 'fix':121C 'found':75C 'function':85C 'getrawbyid':87C 'impact':82C 'issu':123C 'launch':103C 'made':111C 'manipul':93C 'mediacontrol':86C 'possibl':101C 'public':112C 'pull':118C 'remot':106C 'request':119C 'result':94C 'script':98C 'sergix44':77C 'site':97C 'use':116C 'vulner':73C 'xbackbon':78C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-14T18:17:20+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129267","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129267","severity":null,"published_at":"2026-11-14T18:17:20+00:00","modified_at":"2026-11-14T18:17:21+00:00","first_seen_at":"2026-11-14T18:31:01+00:00","fetched_at":"2026-11-14T18:31:01+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}