AXELOZ FILESHARING · CVE-2026-129430 · Other
NO FIX YET · SEE WHAT TO DO
Axeloz Filesharing before 2.14.3 lets an authenticated user store raw HTML or javascript: Markdown links in bundle descriptions. When a recipient opens the public bundle preview page, the script runs and can steal the owner_token from localStorage, then send owner-scoped requests against the victim's bundles.
first public Nov 14, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any deployment of Axeloz Filesharing before 2.14.3 where users can create bundles with descriptions and others open public bundle preview pages. Attackers need an account on the instance; recipients of a crafted bundle link trigger the script when they view the preview page. Instances without public bundle previews or without untrusted users may be lower risk.
Not affected if no-public-bundle-preview, version-2.14.3-or-later
Who cares axeloz-filesharing, self-hosted
2.14.3javascript: links2.14.3 or laterAxeloz Filesharing before 2.14.3 contains a stored cross-site scripting vulnerability that allows authenticated users to inject script by storing raw HTML or javascript: Markdown links in bundle descriptions. Recipients viewing the public bundle preview page execute the script via Alpine x-html, letting attackers steal the owner_token from localStorage and issue owner-scoped requests against victim bundles.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.