CVE-2026-129267: sergix44 XBackBone MediaController.php getRawById cross site scripting
A vulnerability was found in sergix44 XBackBone up to 3.8.2. Impacted is the function MediaController::getRawById of the file app/Controllers/MediaController.php. The manipulation results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker needs low-level privileges and can launch the attack remotely. Exploitation also requires user interaction.
Which deployments are known to be affected?
sergix44 XBackBone versions up to and including 3.8.2 are reported as affected. The vulnerable code is MediaController::getRawById in app/Controllers/MediaController.php.
Is exploitation likely to be practical?
A public exploit is available and could be used. The reported impact is cross-site scripting that can affect integrity, with no reported confidentiality or availability impact.
Is a fix available?
A pull request intended to fix the issue exists but is awaiting acceptance. No released fixed version is identified in the available information.