{"id":"CVE-2026-129430","summary":"axeloz filesharing before 2.14.3 Stored XSS via Bundle Description Markdown Links","details":"Axeloz Filesharing before 2.14.3 contains a stored cross-site scripting vulnerability that allows authenticated users to inject script by storing raw HTML or javascript: Markdown links in bundle descriptions. Recipients viewing the public bundle preview page execute the script via Alpine x-html, letting attackers steal the owner_token from localStorage and issue owner-scoped requests against victim bundles.","modified":"2026-11-15T02:46:42.863010439Z","published":"2026-11-14T12:32:54.682Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/129xxx/CVE-2026-129430.json","cna_assigner":"VulnCheck","cwe_ids":["CWE-79"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/129xxx/CVE-2026-129430.json"},{"type":"PACKAGE","url":"https://github.com/axeloz/filesharing"},{"type":"ARTICLE","url":"https://github.com/axeloz/filesharing/blob/e865be1f09f8eb5a46c4b9a16635de892b093d8f/app/Http/Resources/BundleResource.php#L33"},{"type":"FIX","url":"https://github.com/axeloz/filesharing/commit/366ee452aba636858d55b82068ecc35f6d08b6d6"},{"type":"FIX","url":"https://github.com/axeloz/filesharing/commit/eebc80a77c0e3fe3b8467245ba89fa49f2d35928"},{"type":"FIX","url":"https://github.com/axeloz/filesharing/pull/90"},{"type":"ADVISORY","url":"https://github.com/axeloz/filesharing/releases/tag/2.14.3"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129430"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/axeloz-filesharing-before-2.14.3-stored-xss-via-bundle-description-markdown-links"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/axeloz/filesharing","events":[{"introduced":"0"},{"fixed":"953c694bc4cf8361317417dbc1d881279a205430"},{"fixed":"eebc80a77c0e3fe3b8467245ba89fa49f2d35928"},{"fixed":"366ee452aba636858d55b82068ecc35f6d08b6d6"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"introduced":"0"},{"fixed":"2.14.3"}]},{"range":[{"fixed":"eebc80a77c0e3fe3b8467245ba89fa49f2d35928"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"366ee452aba636858d55b82068ecc35f6d08b6d6"}],"source":"REFERENCES_COMMIT"},{"original_tag":"2.14.3","range":[{"fixed":"953c694bc4cf8361317417dbc1d881279a205430"}],"source":"REFERENCES_TAG"}]}}],"versions":["2.14.2","2.14.1","2.14.0","2.13.4","2.13.2","2.13.1","2.12.6","2.12.5","2.12.4","2.12.3","2.12.2","2.12.1","2.12","2.11","2.10","2.9","2.8","2.7","2.6","2.5","2.4","2.3","2.2","2.1","2.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-129430.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"}]}