{"schema":"threatline.record/2","record":{"id":"CVE-2026-111168","aliases":[],"summary":"LibreDesk before 2.9.0-rc.8 Stored XSS via SVG Upload Content-Type Parameter","details":"LibreDesk before 2.9.0-rc.8 contains a stored cross-site scripting vulnerability that allows authenticated agents to execute script by uploading SVGs with malformed Content-Type parameters. Attackers can upload an SVG typed 'image/svg+xml; x' via /api/v1/media so GET /uploads/{uuid} serves it inline without sandbox, running script in any viewing agent's or administrator's session.","categories":["Unclassified"],"product":"libredesk","vendor":"abhinavxd","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111168","source_modified_at":"2026-10-15T19:40:44.232Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"libredesk","vendor":"abhinavxd","versions":[{"version":"0","lessThan":"2.9.0-rc.8","status":"affected","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111168","source_modified_at":"2026-10-15T19:40:44.232Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"libredesk","ecosystem":null},"version":"2.9.0-rc.8","basis":"first unaffected version stated in the CVE record"}],"cvss":5.1,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00226,"percentile":0.12646,"score_date":"2026-10-23"},"published_at":"2026-10-15T18:57:54.024Z","modified_at":"2026-10-15T19:40:44.232Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-111168","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-15T19:40:44.232Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111168","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/abhinavxd/libredesk/pull/641","tags":["patch","issue-tracking"]},{"source":"CVE List","url":"https://github.com/abhinavxd/libredesk/commit/ab3a5ca682fcc1caec0950fc607b66caea49bec3","tags":["patch"]},{"source":"CVE List","url":"https://github.com/abhinavxd/libredesk/blob/086b08200d667f2cc083635e925d6f5e7b0097e3/cmd/media.go#L255-L272","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/abhinavxd/libredesk/blob/086b08200d667f2cc083635e925d6f5e7b0097e3/internal/media/media.go#L422-L433","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/abhinavxd/libredesk/releases/tag/v2.9.0-rc.8","tags":["release-notes"]},{"source":"CVE List","url":"https://github.com/abhinavxd/libredesk","tags":["product"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/libredesk-before-2.9.0-rc.8-stored-xss-via-svg-upload-content-type-parameter","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-15T19:40:35.337819Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-15T19:40:44.232Z","content_hash":"6b7d84b25dc98931b17794f904442e8fcc40ac320819818799bc2c3edab073af"}}