CVE-2026-67444 · Package
NO FIX YET · SEE WHAT TO DO
Hubleys, a self-hosted services dashboard, lets any logged-in non-admin user upload a background image with an arbitrary file extension. The server serves it back with a Content-Type taken from that extension, so an uploaded HTML file runs attacker script without the app's Content-Security-Policy applied.
first public Jul 4, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams running a self-hosted Hubleys dashboard where non-admin users have accounts and can set a background image. Instances with only admin users, or without the background-upload feature, are less exposed. The sources do not name specific configuration settings beyond the version.
Not affected if admin-only-users, version-0.5.2-or-later
Who cares hubleys, self-hosted, sveltekit
0.5.2 is affected.0.5.2.Hubleys is a dashboard for self-hosted services. Prior to version 0.5.2, any authenticated (non-admin) Hubleys user can upload a file with an arbitrary extension as their dashboard "background image," and the server will later serve that file back with a Content-Type derived straight from the attacker's chosen extension - so uploading an .html file gets it served as text/html. Because the endpoint that serves it returns a manually-constructed response rather than going through SvelteKit's normal page-rendering pipeline, the app's configured Content-Security-Policy never gets attached to it either, so a script embedded in the upload runs unrestricted. This issue has been patched in version 0.5.2.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.