CVE-2026-124491: SunEditor before 3.4.0 Stored XSS via FileUpload Plugin Filename

Published Nov 8, 2026

Updated

SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the FileUpload plugin create() method that assigns server-returned file names to innerHTML without escaping. Attackers can upload files with HTML-laden names that bypass html.clean() and execute JavaScript in victims' browsers when content or gallery items load, enabling session theft.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade SunEditor to a version that resolves this vulnerability.
Fixed in 3.4.0

Event History

Nov 8, 2026

CVE Published

via MITRE·01:16 PM

Data Sourced

via MITRE·01:16 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What must an attacker be able to do to exploit this issue?

The attacker needs privileges to upload a file through the FileUpload plugin and to supply, or cause the server to return, a filename containing HTML. The malicious filename is stored and can execute JavaScript when affected content or gallery items are loaded.

Who is exposed to the stored script?

Users whose browsers load content or gallery items containing the malicious uploaded-file name are exposed. Successful script execution may allow an attacker to steal their sessions.

What versions are affected?

SunEditor versions before 3.4.0 are affected. The issue is in the FileUpload plugin create() method, which assigns server-returned filenames to innerHTML without escaping.

CVE-2026-124491: SunEditor before 3.4.0 Stored XSS via FileUpload Plugin Filename

Remediation

Event History

Frequently Asked Questions

What must an attacker be able to do to exploit this issue?

Who is exposed to the stored script?

What versions are affected?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker be able to do to exploit this issue?

Who is exposed to the stored script?

What versions are affected?