---
id: "CVE-2026-71881"
page: "https://infrastack.ai/live/CVE-2026-71881"
kind: "vulnerability"
aliases: ["CVE-2026-71881"]
title: "GBIF Integrated Publishing Toolkit: stored XSS in resource metadata fields"
severity: "medium"
cvss: 4.8
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["gbif-ipt", "java", "other", "self-hosted"]
not_affected_if: ["single-trusted-user", "version-3.3.5-or-later"]
published_at: "2026-11-07T00:16:58+00:00"
first_seen_at: "2026-11-07T00:44:49+00:00"
updated_at: "2026-11-07T00:45:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-71881", "first_seen_at": "2026-11-07T00:44:49+00:00"}]
exploit_sources: []
---

# GBIF Integrated Publishing Toolkit: stored XSS in resource metadata fields

Link for people: https://infrastack.ai/live/CVE-2026-71881 (this .md is for agents)

GBIF Integrated Publishing Toolkit (IPT) versions before 3.3.5 let an authenticated user store malicious script in resource metadata fields. When another user views that metadata, the script runs in their session after they interact with the page.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed IPT version in the application's about or version page; versions below `3.3.5` are listed as affected.
- Confirm whether untrusted users can create or edit resources in the IPT instance.

## Fix

- GBIF Integrated Publishing Toolkit: upgrade to `3.3.5` or later (per the description's fixed range).

## Timeline

- 2026-11-07T00:44:49+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-71881

## From the sources

Multiple injection issues in resource metadata fields in GBIF Integrated Publishing Toolkit versions before 3.3.5 allows authenticated remote attackers to execute code in another user's session after user interaction via stored cross-site scripting

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_