CVE-2026-60043: XSS in backend
An unauthenticated remote attacker can perform a XSS attack on a logged in backend user allowing for execution of multiple critical system actions. This could allow an attacker to shutdown the server or restore an uploaded backup. This can result in a loss of integrity and availability.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Organizations with logged-in backend users are exposed, because an unauthenticated remote attacker can target those users with an XSS attack. Exploitation requires user interaction from a backend user.
What could an attacker do after successful exploitation?
The attacker could execute multiple critical system actions in the backend user's context. Documented impacts include shutting down the server or restoring an uploaded backup, causing integrity and availability loss.
Does an attacker need an account or backend credentials?
No. The issue is described as exploitable by an unauthenticated remote attacker, although a logged-in backend user must be induced to interact with the XSS payload.