{"id":"CVE-2026-129430","kind":"vulnerability","aliases":["CVE-2026-129430"],"related":[],"title":"Axeloz Filesharing: stored XSS in bundle descriptions steals owner tokens","description":"Axeloz Filesharing before 2.14.3 contains a stored cross-site scripting vulnerability that allows authenticated users to inject script by storing raw HTML or javascript: Markdown links in bundle descriptions. Recipients viewing the public bundle preview page execute the script via Alpine x-html, letting attackers steal the owner_token from localStorage and issue owner-scoped requests against victim bundles.","summary":"Axeloz Filesharing before 2.14.3 lets an authenticated user store raw HTML or javascript: Markdown links in bundle descriptions. When a recipient opens the public bundle preview page, the script runs and can steal the owner_token from localStorage, then send owner-scoped requests against the victim's bundles.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Axeloz Filesharing","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["axeloz-filesharing","other","self-hosted"],"not_affected_if":["no-public-bundle-preview","version-2.14.3-or-later"],"how_to_check":"- Check the installed Axeloz Filesharing version against `2.14.3`\n- Look for bundle descriptions containing raw HTML or `javascript:` links","fix":"- Axeloz Filesharing: upgrade to `2.14.3` or later","status":"open","published_at":"2026-11-14T13:17:22+00:00","first_seen_at":"2026-11-14T13:28:10+00:00","triaged_at":"2026-11-14T13:29:07+00:00","updated_at":"2026-11-14T13:29:07+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-14T13:29:07Z","model":"claude-haiku-5-5","output":{"fix":"- Axeloz Filesharing: upgrade to `2.14.3` or later","reach":"internet","title":"Axeloz Filesharing: stored XSS in bundle descriptions steals owner tokens","impact":"medium","summary":"Axeloz Filesharing before 2.14.3 lets an authenticated user store raw HTML or javascript: Markdown links in bundle descriptions. When a recipient opens the public bundle preview page, the script runs and can steal the owner_token from localStorage, then send owner-scoped requests against the victim's bundles.","audience":"businesses","category":"other","nicknames":[],"who_cares":["axeloz-filesharing","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker steals owner tokens and acts on victims' bundles","analyst_note":"Confirm the fixed version and the patch commit on github.com linked in the sources, and whether the public preview page is enabled by default.","how_to_check":"- Check the installed Axeloz Filesharing version against `2.14.3`\n- Look for bundle descriptions containing raw HTML or `javascript:` links\n- unknown for other checks","plain_action":"","product_name":"Axeloz Filesharing","needs_analyst":true,"not_affected_if":["version-2.14.3-or-later","no-public-bundle-preview"],"who_is_affected":"Any deployment of Axeloz Filesharing before 2.14.3 where users can create bundles with descriptions and others open public bundle preview pages. Attackers need an account on the instance; recipients of a crafted bundle link trigger the script when they view the preview page. Instances without public bundle previews or without untrusted users may be lower risk.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000789,"input_tokens":4657,"output_tokens":647,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-129430':13A,16A '-2026':12A,15A '2.14.3':29B,78C 'allow':88C 'alpin':116C 'attack':121C 'authent':32B,89C 'axeloz':1A,17A,20B,26B,75C 'axeloz-fileshar':19B 'bundl':6A,42B,50B,74B,103C,109C,136C 'contain':79C 'cross':83C 'cross-sit':82C 'cve':11A,14A 'descript':7A,43B,104C 'execut':112C 'fileshar':2A,21B,27B,76C 'filesharing':18A 'host':25B 'html':36B,97C,119C 'inject':92C 'issu':129C 'javascript':38B,99C 'let':30B,120C 'link':40B,101C 'localstorag':63B,127C 'markdown':39B,100C 'open':47B 'owner':9A,60B,67B,124C,131C 'owner-scop':66B,130C 'page':52B,111C 'preview':51B,110C 'public':49B,108C 'raw':35B,96C 'recipi':46B,105C 'request':69B,133C 'run':55B 'scope':68B,132C 'script':54B,85C,93C,114C 'self':24B 'self-host':23B 'send':65B 'site':84C 'steal':8A,58B,122C 'store':3A,34B,81C,95C 'token':10A,61B,125C 'user':33B,90C 'via':115C 'victim':72B,135C 'view':106C 'vulner':86C 'x':118C 'x-html':117C 'xss':4A","nicknames":[],"mitigations":[],"who_affected":"Any deployment of Axeloz Filesharing before 2.14.3 where users can create bundles with descriptions and others open public bundle preview pages. Attackers need an account on the instance; recipients of a crafted bundle link trigger the script when they view the preview page. Instances without public bundle previews or without untrusted users may be lower risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["axelozfilesharing","filesharing"],"ptokens":["axeloz","filesharing"],"labels":["axelozfilesharing","medium","other","selfhosted","vendor"],"campaign_type":null,"search_a":"'-129430':13A,16A '-2026':12A,15A 'axeloz':1A,17A 'bundl':6A 'cve':11A,14A 'descript':7A 'fileshar':2A 'filesharing':18A 'owner':9A 'steal':8A 'store':3A 'token':10A 'xss':4A","search_b":"'2.14.3':29B 'authent':32B 'axeloz':20B,26B 'axeloz-fileshar':19B 'bundl':42B,50B,74B 'descript':43B 'fileshar':21B,27B 'host':25B 'html':36B 'javascript':38B 'let':30B 'link':40B 'localstorag':63B 'markdown':39B 'open':47B 'owner':60B,67B 'owner-scop':66B 'page':52B 'preview':51B 'public':49B 'raw':35B 'recipi':46B 'request':69B 'run':55B 'scope':68B 'script':54B 'self':24B 'self-host':23B 'send':65B 'steal':58B 'store':34B 'token':61B 'user':33B 'victim':72B","search_c":"'2.14.3':78C 'allow':88C 'alpin':116C 'attack':121C 'authent':89C 'axeloz':75C 'bundl':103C,109C,136C 'contain':79C 'cross':83C 'cross-sit':82C 'descript':104C 'execut':112C 'fileshar':76C 'html':97C,119C 'inject':92C 'issu':129C 'javascript':99C 'let':120C 'link':101C 'localstorag':127C 'markdown':100C 'owner':124C,131C 'owner-scop':130C 'page':111C 'preview':110C 'public':108C 'raw':96C 'recipi':105C 'request':133C 'scope':132C 'script':85C,93C,114C 'site':84C 'steal':122C 'store':81C,95C 'token':125C 'user':90C 'via':115C 'victim':135C 'view':106C 'vulner':86C 'x':118C 'x-html':117C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-14T13:17:22+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129430","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129430","severity":null,"published_at":"2026-11-14T13:17:22+00:00","modified_at":"2026-11-14T13:17:22+00:00","first_seen_at":"2026-11-14T13:28:10+00:00","fetched_at":"2026-11-14T13:28:10+00:00","note":null}],"documents":[{"id":155844,"url":"https://github.com/axeloz/filesharing/commit/366ee452aba636858d55b82068ecc35f6d08b6d6","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":155845,"url":"https://github.com/axeloz/filesharing/commit/eebc80a77c0e3fe3b8467245ba89fa49f2d35928","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":155846,"url":"https://github.com/axeloz/filesharing/releases/tag/2.14.3","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":155847,"url":"https://www.vulncheck.com/advisories/axeloz-filesharing-before-2.14.3-stored-xss-via-bundle-description-markdown-links","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}