CVE-2026-63147: Omnispace Agora Project < 26.10.0 Stored XSS via Uploaded File Name
Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious script by uploading a file with HTML/script markup embedded in its filename, which bypasses the paramFilter since uploaded-file names arrive through $FILES rather than $GET/$POST. Attackers can upload a file with a crafted name such as an SVG onload payload to have the unsanitized filename stored and later rendered to other users, resulting in script execution in their browsers.
Affected Software
Event History
Frequently Asked Questions
What access and interaction are required to exploit this issue?
An attacker needs an authenticated account and the ability to upload a file with HTML or script markup in its filename. Script execution occurs later when another user views a page that renders the stored filename.
Which users are at risk from a malicious upload?
Users who browse content or interfaces that render the crafted uploaded filename may have attacker-controlled script execute in their browser. The attacker does not need to directly target a specific user if the filename is displayed to other users.
What is the available remediation?
Upgrade Omnispace Agora Project to version 26.10.0 or later. The issue affects versions before 26.10.0.
How can I look for possible prior exploitation?
Review uploaded-file records and filenames for embedded HTML or script-like markup, including SVG event-handler payloads. Pay particular attention to filenames that may have been rendered in pages viewed by other users.