CVE-2026-124435: OpenRemote before 1.32.2 Stored XSS via Manager Configuration Image Upload

Published Nov 8, 2026

Updated

OpenRemote before 1.32.2 contains a stored cross-site scripting vulnerability that allows authenticated users with write:admin permissions to upload HTML or SVG files containing JavaScript via the Manager configuration file upload endpoint. Attackers can lure victims to the unauthenticated image retrieval endpoint, which serves files as text/html or image/svg+xml, executing scripts within the application's origin.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade OpenRemote to a version that resolves this vulnerability.
Fixed in 1.32.2

Event History

Nov 8, 2026

CVE Published

via MITRE·01:15 PM

Data Sourced

via MITRE·01:15 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated OpenRemote user with write:admin permissions can upload a malicious HTML or SVG file through the Manager configuration file upload endpoint. Exploitation also requires a victim to visit the uploaded file through the unauthenticated image retrieval endpoint.

Are unauthenticated users exposed?

Unauthenticated users cannot perform the malicious upload based on the available information, but they can be lured to the retrieval endpoint. When they access an uploaded HTML or SVG payload, JavaScript can execute in the OpenRemote application origin.

Which deployments are affected?

OpenRemote versions before 1.32.2 are affected. The vulnerable behavior involves the Manager configuration upload endpoint accepting HTML or SVG files and the retrieval endpoint serving them with text/html or image/svg+xml content types.

What is the immediate mitigation if upgrading is not possible?

The available information supports restricting write:admin permissions to trusted users, since those permissions are required to upload a payload. Limiting access to the unauthenticated image retrieval endpoint may also reduce the opportunity to lure victims to malicious uploaded files.

CVE-2026-124435: OpenRemote before 1.32.2 Stored XSS via Manager Configuration Image Upload

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Are unauthenticated users exposed?

Which deployments are affected?

What is the immediate mitigation if upgrading is not possible?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Are unauthenticated users exposed?

Which deployments are affected?

What is the immediate mitigation if upgrading is not possible?