{"id":"CVE-2021-26799","details":"Cross Site Scripting (XSS) vulnerability in admin/files/edit in Omeka Classic \u003c=2.7 allows remote attackers to inject arbitrary web script or HTML.","modified":"2026-07-09T00:13:12.693488Z","published":"2021-07-23T11:15:08.820Z","references":[{"type":"FIX","url":"https://github.com/omeka/Omeka/commit/08bfdf470e234edb68e5307a2fef8c899d89256c"},{"type":"EVIDENCE","url":"https://github.com/omeka/Omeka/issues/935"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/omeka/omeka","events":[{"introduced":"0"},{"last_affected":"c27df538c3410eef05f99b39633368864302eaeb"},{"fixed":"08bfdf470e234edb68e5307a2fef8c899d89256c"}],"database_specific":{"cpe":"cpe:2.3:a:omeka:omeka:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"2.7"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["v2.7.1","v2.7","v2.6.1","v2.6","v2.5","v2.4","v2.3.1","v2.3","v2.2.2","v2.2.1","v2.2","v2.1.4","v2.1.3","v2.1.2","v2.1.1","v2.1","v2.1-rc1","v2.0.2","v2.0.1","v2.0","v2.0-rc1","v2.0-beta","v2.0-alpha-2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-26799.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}