CVE-2026-11569: Quay: quay: stored xss via filedrop svg upload
A flaw was found in Quay. The filedrop endpoint accepts any mime type without validation, allowing an authenticated user with repository write access to upload a malicious SVG file containing JavaScript. The file is stored and served inline through the CDN, enabling stored cross-site scripting when a victim visits the archive URL.
Other sources
The filedrop endpoint (POST /api/v1/filedrop/) accepts any mimeType without validation, including image/svg+xml, text/html, and application/javascript. An attacker with repository write access can upload a malicious SVG file containing JavaScript, create a build referencing the fileid, and obtain an archiveurl that serves the SVG through the CDN. When a victim visits the archive URL, the browser renders the SVG inline and executes the embedded JavaScript. The malicious SVG is stored in the object storage backend and served through a legitimate Quay domain. However, session hijacking is not possible as the csrftoken session cookie is configured with HttpOnly and Secure attributes.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Validate the mimeType of uploads at the filedrop endpoint and reject uploads that declare image/svg+xml, text/html, or application/javascript. Only accept explicitly allowed safe mime types.
Quay (filedrop endpoint /api/v1/filedrop/) mimeType validation / accepted_mime_types = reject image/svg+xml, text/html, application/javascript - Configuration
Serve archived/uploaded files with Content-Disposition: attachment (or otherwise prevent inline rendering) so browsers will not render uploaded SVGs inline via the archive URL.
Quay / CDN / object storage response headers Content-Disposition for archived files = attachment - Configuration
Sanitize uploaded SVG files (remove scripts/active content) or disallow SVG content before storing in object storage to prevent embedded JavaScript from being served.
Quay upload processing SVG sanitization = enabled - Compensating control
Deploy edge/ CDN / WAF rules to block or rewrite uploads and responses involving image/svg+xml, text/html, or application/javascript (for example, block SVG uploads at the edge or force downloads for these content types) until in-application fixes are applied.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11569?
CVE-2026-11569 has a medium severity rating of 5.4.
What vulnerabilities are associated with CVE-2026-11569?
CVE-2026-11569 is associated with stored cross-site scripting (XSS) due to unvalidated SVG file uploads.
How do I fix CVE-2026-11569?
To fix CVE-2026-11569, ensure proper MIME type validation for file uploads in Quay.
Who is affected by CVE-2026-11569?
CVE-2026-11569 affects users with repository write access in Red Hat Quay.
When was CVE-2026-11569 published?
CVE-2026-11569 was published on June 8, 2026.