CVE-2026-129172: EdgeEver 1.9.0 before 2.13.0 Stored XSS via Backup Restore and Public Shares

Q: Who can exploit this vulnerability, and what interaction is required from the victim?

An authenticated EdgeEver member can exploit it by uploading crafted content through the backup restore endpoint, sharing the associated note, and sending its public blob link to a victim. The victim must open that public link in a browser for the script to execute.

Q: What can an attacker gain if the exploit succeeds?

The injected script can mint a non-expiring API token with read and write access to the victim's notes. This enables the attacker to access and modify the victim's note data using that token.

Q: Which deployments are affected?

EdgeEver versions from 1.9.0 up to, but not including, 2.13.0 are affected. Exploitation depends on an attacker having authenticated member access and being able to use public blob links to target a victim.

Published Nov 13, 2026

Updated

EdgeEver 1.9.0 before 2.13.0 contains a stored cross-site scripting vulnerability in the backup restore endpoint PUT /api/v1/restores/json/resources/:id, which accepts a resource kind of image paired with a text/html MIME type without checking consistency. Authenticated members can share the note and send the public blob link to a victim, whose browser executes the script to mint a non-expiring API token granting read and write access to the victim's notes.

Affected Software

1 affected component

EdgeEver EdgeEver>=1.9.0<2.13.0

Event History

Nov 13, 2026

CVE Published

via MITRE·05:21 PM

Data Sourced

via MITRE·05:21 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·06:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this vulnerability, and what interaction is required from the victim?

An authenticated EdgeEver member can exploit it by uploading crafted content through the backup restore endpoint, sharing the associated note, and sending its public blob link to a victim. The victim must open that public link in a browser for the script to execute.

What can an attacker gain if the exploit succeeds?

The injected script can mint a non-expiring API token with read and write access to the victim's notes. This enables the attacker to access and modify the victim's note data using that token.

Which deployments are affected?

EdgeEver versions from 1.9.0 up to, but not including, 2.13.0 are affected. Exploitation depends on an attacker having authenticated member access and being able to use public blob links to target a victim.

CVE-2026-129172: EdgeEver 1.9.0 before 2.13.0 Stored XSS via Backup Restore and Public Shares

Affected Software

Event History

Frequently Asked Questions

Who can exploit this vulnerability, and what interaction is required from the victim?

What can an attacker gain if the exploit succeeds?

Which deployments are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this vulnerability, and what interaction is required from the victim?

What can an attacker gain if the exploit succeeds?

Which deployments are affected?