CVE-2026-129430: axeloz filesharing before 2.14.3 Stored XSS via Bundle Description Markdown Links

Q: Who can exploit this issue, and who is exposed to the malicious script?

An authenticated user who can modify a bundle description can store the payload. Recipients who view the affected bundle's public preview page execute it.

Q: What access can an attacker gain after a recipient triggers the payload?

The script can steal the owner_token from the recipient's localStorage and use it to make owner-scoped requests against that victim's bundles.

Q: Which versions are affected?

Axeloz Filesharing versions before 2.14.3 are affected.

Published Nov 14, 2026

Updated

Axeloz Filesharing before 2.14.3 contains a stored cross-site scripting vulnerability that allows authenticated users to inject script by storing raw HTML or javascript: Markdown links in bundle descriptions. Recipients viewing the public bundle preview page execute the script via Alpine x-html, letting attackers steal the ownertoken from localStorage and issue owner-scoped requests against victim bundles.

Affected Software

1 affected component

Axeloz Filesharing<2.14.3

Event History

Nov 14, 2026

CVE Published

via MITRE·12:32 PM

Data Sourced

via MITRE·12:32 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue, and who is exposed to the malicious script?

An authenticated user who can modify a bundle description can store the payload. Recipients who view the affected bundle's public preview page execute it.

What access can an attacker gain after a recipient triggers the payload?

The script can steal the owner_token from the recipient's localStorage and use it to make owner-scoped requests against that victim's bundles.

Which versions are affected?

Axeloz Filesharing versions before 2.14.3 are affected.

CVE-2026-129430: axeloz filesharing before 2.14.3 Stored XSS via Bundle Description Markdown Links

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue, and who is exposed to the malicious script?

What access can an attacker gain after a recipient triggers the payload?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue, and who is exposed to the malicious script?

What access can an attacker gain after a recipient triggers the payload?

Which versions are affected?