{"id":"CVE-2026-71881","kind":"vulnerability","aliases":["CVE-2026-71881"],"related":[],"title":"GBIF Integrated Publishing Toolkit: stored XSS in resource metadata fields","description":"Multiple injection issues in resource metadata fields in GBIF Integrated Publishing Toolkit versions before 3.3.5 allows authenticated remote attackers to execute code in another user's session after user interaction via stored cross-site scripting","summary":"GBIF Integrated Publishing Toolkit (IPT) versions before 3.3.5 let an authenticated user store malicious script in resource metadata fields. When another user views that metadata, the script runs in their session after they interact with the page.","severity":"medium","cvss":4.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gbif-ipt","java","other","self-hosted"],"not_affected_if":["single-trusted-user","version-3.3.5-or-later"],"how_to_check":"- Check the installed IPT version in the application's about or version page; versions below `3.3.5` are listed as affected.\n- Confirm whether untrusted users can create or edit resources in the IPT instance.","fix":"- GBIF Integrated Publishing Toolkit: upgrade to `3.3.5` or later (per the description's fixed range).","status":"open","published_at":"2026-11-07T00:16:58+00:00","first_seen_at":"2026-11-07T00:44:49+00:00","triaged_at":"2026-11-07T00:45:43+00:00","updated_at":"2026-11-07T00:45:43+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-07T00:45:43Z","model":"claude-haiku-5-5","output":{"fix":"- GBIF Integrated Publishing Toolkit: upgrade to `3.3.5` or later (per the description's fixed range).","reach":"network","title":"GBIF Integrated Publishing Toolkit: stored XSS in resource metadata fields","impact":"medium","summary":"GBIF Integrated Publishing Toolkit (IPT) versions before 3.3.5 let an authenticated user store malicious script in resource metadata fields. When another user views that metadata, the script runs in their session after they interact with the page.","audience":"businesses","category":"other","nicknames":[],"who_cares":["gbif-ipt","self-hosted","java"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"script runs in another user's session, stealing their session access","analyst_note":"","how_to_check":"- Check the installed IPT version in the application's about or version page; versions below `3.3.5` are listed as affected.\n- Confirm whether untrusted users can create or edit resources in the IPT instance.","plain_action":"","needs_analyst":false,"not_affected_if":["version-3.3.5-or-later","single-trusted-user"],"who_is_affected":"Teams that run a self-hosted GBIF Integrated Publishing Toolkit instance below 3.3.5 where more than one user can edit resource metadata. The attacker needs a valid account and a victim must interact with the injected content. Instances that are only used by trusted editors have a lower risk.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000693,"input_tokens":4211,"output_tokens":544,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-71881':13A,16A '3.3.5':32B,76C 'allow':77C 'anoth':45B,85C 'attack':80C 'authent':35B,78C 'code':83C 'cross':95C 'cross-sit':94C 'cve':11A,14A 'execut':82C 'field':10A,43B,68C 'gbif':1A,18B,25B,70C 'gbif-ipt':17B 'host':24B 'inject':63C 'integr':2A,26B,71C 'interact':58B,91C 'ipt':19B,29B 'issu':64C 'java':20B 'let':33B 'malici':38B 'metadata':9A,42B,49B,67C 'multipl':62C 'page':61B 'publish':3A,27B,72C 'remot':79C 'resourc':8A,41B,66C 'run':52B 'script':39B,51B,97C 'self':23B 'self-host':22B 'session':55B,88C 'site':96C 'store':5A,37B,93C 'toolkit':4A,28B,73C 'user':36B,46B,86C,90C 'version':30B,74C 'via':92C 'view':47B 'xss':6A","nicknames":[],"mitigations":[],"who_affected":"Teams that run a self-hosted GBIF Integrated Publishing Toolkit instance below 3.3.5 where more than one user can edit resource metadata. The attacker needs a valid account and a victim must interact with the injected content. Instances that are only used by trusted editors have a lower risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["gbifipt","java","medium","other","selfhosted"],"campaign_type":null,"search_a":"'-2026':12A,15A '-71881':13A,16A 'cve':11A,14A 'field':10A 'gbif':1A 'integr':2A 'metadata':9A 'publish':3A 'resourc':8A 'store':5A 'toolkit':4A 'xss':6A","search_b":"'3.3.5':32B 'anoth':45B 'authent':35B 'field':43B 'gbif':18B,25B 'gbif-ipt':17B 'host':24B 'integr':26B 'interact':58B 'ipt':19B,29B 'java':20B 'let':33B 'malici':38B 'metadata':42B,49B 'page':61B 'publish':27B 'resourc':41B 'run':52B 'script':39B,51B 'self':23B 'self-host':22B 'session':55B 'store':37B 'toolkit':28B 'user':36B,46B 'version':30B 'view':47B","search_c":"'3.3.5':76C 'allow':77C 'anoth':85C 'attack':80C 'authent':78C 'code':83C 'cross':95C 'cross-sit':94C 'execut':82C 'field':68C 'gbif':70C 'inject':63C 'integr':71C 'interact':91C 'issu':64C 'metadata':67C 'multipl':62C 'publish':72C 'remot':79C 'resourc':66C 'script':97C 'session':88C 'site':96C 'store':93C 'toolkit':73C 'user':86C,90C 'version':74C 'via':92C","first_public_at":"2026-11-07T00:16:58+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"mandiant-cve@google.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-71881","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71881","severity":null,"published_at":"2026-11-07T00:16:58+00:00","modified_at":"2026-11-07T00:16:58+00:00","first_seen_at":"2026-11-07T00:44:49+00:00","fetched_at":"2026-11-07T00:44:49+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}