CERVANTES · CVE-2026-129427 · Other
NO FIX YET · SEE WHAT TO DO
Cervantes v1.3-beta has a stored cross-site scripting flaw in avatar uploads, chained with an authentication bypass in the /Attachments path. An attacker can run script in another user's browser with that user's elevated privileges, leading to account takeover.
first public Nov 14, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that self-host CervantesSec Cervantes v1.3-beta, a pentest/vulnerability management app. A user who can upload an avatar can store script that runs in another user's browser, combined with an auth bypass on the /Attachments path, leading to account takeover. Teams not running Cervantes, or with it reachable only by trusted users, can skip it.
Who cares auth-bypass, cervantes, self-hosted, xss
v1.4.0-beta release notes describe hardening of avatar uploads (images only), attachment serving and CSP, but do not name this CVEv1.4.0-beta or later is a reasonable step; not confirmed as the fixPosts are quoted with a link to the original. They are data to us, never instructions.
Stored XSS via avatar upload chained with an authentication bypass in /Attachments leads to ATO in Cervantes version v1.3-beta could allow an attacker to execute arbitrary code in another user's browser with elevated privileges
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.