---
id: "CVE-2026-129267"
page: "https://infrastack.ai/live/CVE-2026-129267"
kind: "vulnerability"
aliases: ["CVE-2026-129267"]
title: "XBackBone: flaw in raw media endpoint enables cross-site scripting"
severity: "medium"
cvss: 4.0
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["php", "runtime", "self-hosted", "xbackbone"]
not_affected_if: ["xbackbone-newer-than-3.8.2"]
published_at: "2026-11-14T18:17:20+00:00"
first_seen_at: "2026-11-14T18:31:01+00:00"
updated_at: "2026-11-14T18:32:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-129267", "first_seen_at": "2026-11-14T18:31:01+00:00"}]
exploit_sources: []
---

# XBackBone: flaw in raw media endpoint enables cross-site scripting

Link for people: https://infrastack.ai/live/CVE-2026-129267 (this .md is for agents)

XBackBone, a self-hosted file-sharing and screenshot server, has a cross-site scripting flaw in its MediaController::getRawById function. An attacker who can get a victim to load a crafted link could run scripts in the victim's browser session on the XBackBone site.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Look at the installed XBackBone version and compare it with `3.8.2`, which the sources list as affected.
- Check whether `app/Controllers/MediaController.php` in your install contains the `getRawById` function.

## Timeline

- 2026-11-14T18:31:01+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-129267

## From the sources

A vulnerability was found in sergix44 XBackBone up to 3.8.2. Impacted is the function MediaController::getRawById of the file app/Controllers/MediaController.php. The manipulation results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_