{"id":"CVE-2026-67444","kind":"vulnerability","aliases":["CVE-2026-67444"],"related":[],"title":"Hubleys: uploaded background image served as HTML runs scripts","description":"Hubleys is a dashboard for self-hosted services. Prior to version 0.5.2, any authenticated (non-admin) Hubleys user can upload a file with an arbitrary extension as their dashboard \"background image,\" and the server will later serve that file back with a Content-Type derived straight from the attacker's chosen extension - so uploading an .html file gets it served as text/html. Because the endpoint that serves it returns a manually-constructed response rather than going through SvelteKit's normal page-rendering pipeline, the app's configured Content-Security-Policy never gets attached to it either, so a script embedded in the upload runs unrestricted. This issue has been patched in version 0.5.2.","summary":"Hubleys, a self-hosted services dashboard, lets any logged-in non-admin user upload a background image with an arbitrary file extension. The server serves it back with a Content-Type taken from that extension, so an uploaded HTML file runs attacker script without the app's Content-Security-Policy applied.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hubleys","package","self-hosted","sveltekit"],"not_affected_if":["admin-only-users","version-0.5.2-or-later"],"how_to_check":"- Check the installed Hubleys version; anything below `0.5.2` is affected.\n- Check whether non-admin users can upload a dashboard background image.","fix":"- Hubleys: upgrade to `0.5.2`.","status":"open","published_at":"2026-11-13T19:19:34+00:00","first_seen_at":"2026-11-13T19:52:10+00:00","triaged_at":"2026-11-13T19:54:08+00:00","updated_at":"2026-11-13T19:54:08+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T19:54:08Z","model":"claude-haiku-5-5","output":{"fix":"- Hubleys: upgrade to `0.5.2`.","reach":"network","title":"Hubleys: uploaded background image served as HTML runs scripts","impact":"medium","summary":"Hubleys, a self-hosted services dashboard, lets any logged-in non-admin user upload a background image with an arbitrary file extension. The server serves it back with a Content-Type taken from that extension, so an uploaded HTML file runs attacker script without the app's Content-Security-Policy applied.","audience":"businesses","category":"package","nicknames":[],"who_cares":["hubleys","self-hosted","sveltekit"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"attacker script runs in other users' browsers on the dashboard","analyst_note":"","how_to_check":"- Check the installed Hubleys version; anything below `0.5.2` is affected.\n- Check whether non-admin users can upload a dashboard background image.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["admin-only-users","version-0.5.2-or-later"],"who_is_affected":"Teams running a self-hosted Hubleys dashboard where non-admin users have accounts and can set a background image. Instances with only admin users, or without the background-upload feature, are less exposed. The sources do not name specific configuration settings beyond the version.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000731,"input_tokens":4699,"output_tokens":522,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-67444':12A,15A '0.5.2':90C,196C 'admin':36B,95C 'app':71B,167C 'appli':77B 'arbitrari':44B,104C 'attach':176C 'attack':67B,129C 'authent':92C 'back':51B,119C 'background':3A,40B,109C 'chosen':131C 'configur':169C 'construct':153C 'content':55B,74B,123C,171C 'content-security-polici':73B,170C 'content-typ':54B,122C 'cve':10A,13A 'dashboard':28B,81C,108C 'deriv':125C 'either':179C 'embed':183C 'endpoint':145C 'extens':46B,60B,105C,132C 'file':45B,65B,101C,118C,137C 'get':138C,175C 'go':157C 'host':20B,26B,85C 'html':7A,64B,136C 'hubley':1A,16B,22B,78C,96C 'imag':4A,41B,110C 'issu':190C 'later':115C 'let':29B 'log':32B 'logged-in':31B 'manual':152C 'manually-construct':151C 'never':174C 'non':35B,94C 'non-admin':34B,93C 'normal':161C 'packag':17B 'page':163C 'page-rend':162C 'patch':193C 'pipelin':165C 'polici':76B,173C 'prior':87C 'rather':155C 'render':164C 'respons':154C 'return':149C 'run':8A,66B,187C 'script':9A,68B,182C 'secur':75B,172C 'self':19B,25B,84C 'self-host':18B,24B,83C 'serv':5A,49B,116C,140C,147C 'server':48B,113C 'servic':27B,86C 'straight':126C 'sveltekit':21B,159C 'taken':57B 'text/html':142C 'type':56B,124C 'unrestrict':188C 'upload':2A,38B,63B,99C,134C,186C 'user':37B,97C 'version':89C,195C 'without':69B","nicknames":[],"mitigations":[],"who_affected":"Teams running a self-hosted Hubleys dashboard where non-admin users have accounts and can set a background image. Instances with only admin users, or without the background-upload feature, are less exposed. The sources do not name specific configuration settings beyond the version.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","hubleys","package","selfhosted","sveltekit"],"campaign_type":null,"search_a":"'-2026':11A,14A '-67444':12A,15A 'background':3A 'cve':10A,13A 'html':7A 'hubley':1A 'imag':4A 'run':8A 'script':9A 'serv':5A 'upload':2A","search_b":"'admin':36B 'app':71B 'appli':77B 'arbitrari':44B 'attack':67B 'back':51B 'background':40B 'content':55B,74B 'content-security-polici':73B 'content-typ':54B 'dashboard':28B 'extens':46B,60B 'file':45B,65B 'host':20B,26B 'html':64B 'hubley':16B,22B 'imag':41B 'let':29B 'log':32B 'logged-in':31B 'non':35B 'non-admin':34B 'packag':17B 'polici':76B 'run':66B 'script':68B 'secur':75B 'self':19B,25B 'self-host':18B,24B 'serv':49B 'server':48B 'servic':27B 'sveltekit':21B 'taken':57B 'type':56B 'upload':38B,63B 'user':37B 'without':69B","search_c":"'0.5.2':90C,196C 'admin':95C 'app':167C 'arbitrari':104C 'attach':176C 'attack':129C 'authent':92C 'back':119C 'background':109C 'chosen':131C 'configur':169C 'construct':153C 'content':123C,171C 'content-security-polici':170C 'content-typ':122C 'dashboard':81C,108C 'deriv':125C 'either':179C 'embed':183C 'endpoint':145C 'extens':105C,132C 'file':101C,118C,137C 'get':138C,175C 'go':157C 'host':85C 'html':136C 'hubley':78C,96C 'imag':110C 'issu':190C 'later':115C 'manual':152C 'manually-construct':151C 'never':174C 'non':94C 'non-admin':93C 'normal':161C 'page':163C 'page-rend':162C 'patch':193C 'pipelin':165C 'polici':173C 'prior':87C 'rather':155C 'render':164C 'respons':154C 'return':149C 'run':187C 'script':182C 'secur':172C 'self':84C 'self-host':83C 'serv':116C,140C,147C 'server':113C 'servic':86C 'straight':126C 'sveltekit':159C 'text/html':142C 'type':124C 'unrestrict':188C 'upload':99C,134C,186C 'user':97C 'version':89C,195C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-04T14:37:07+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-67444","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67444","severity":null,"published_at":"2026-11-13T19:19:34+00:00","modified_at":"2026-11-13T19:19:34+00:00","first_seen_at":"2026-11-13T19:52:10+00:00","fetched_at":"2026-11-13T19:52:10+00:00","note":null}],"documents":[{"id":149168,"url":"https://github.com/knrdl/hubleys-dashboard/commit/5a7f04c153295d48319d35fdd53e30f50288cd37","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":149169,"url":"https://github.com/knrdl/hubleys-dashboard/releases/tag/v0.5.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":149170,"url":"https://github.com/knrdl/hubleys-dashboard/security/advisories/GHSA-j2w9-hhqw-mrq8","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-04T14:37:07+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}