CVE-2026-111168: LibreDesk before 2.9.0-rc.8 Stored XSS via SVG Upload Content-Type Parameter
LibreDesk before 2.9.0-rc.8 contains a stored cross-site scripting vulnerability that allows authenticated agents to execute script by uploading SVGs with malformed Content-Type parameters. Attackers can upload an SVG typed 'image/svg+xml; x' via /api/v1/media so GET /uploads/{uuid} serves it inline without sandbox, running script in any viewing agent's or administrator's session.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue and who is at risk from the payload?
An authenticated LibreDesk agent can upload the malicious SVG. Any agent or administrator who views the uploaded file may have script run in their authenticated session.
What conditions are required for exploitation?
The attacker needs valid agent-level authentication and must convince another agent or administrator to view the uploaded SVG. The upload is sent to /api/v1/media with a malformed Content-Type parameter such as image/svg+xml; x.
Are uploaded SVG files served in a way that allows script execution?
Yes. A qualifying SVG uploaded before 2.9.0-rc.8 can be served inline from /uploads/{uuid} without a sandbox, allowing its script to execute when viewed.