CVE-2026-63148: Omnispace Agora Project < 26.10.0 Stored XSS via Poll-Response Attachment Filename
Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject HTML/script markup by uploading a poll-response attachment with a malicious filename that bypasses the paramFilter sanitization applied to $FILES. Attackers can submit a crafted filename that is stored and later rendered in components such as the dashboard controller (CtrlDashboard), executing arbitrary script in the browsers of users who view the affected page.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users who view pages that render poll-response attachment filenames, including components such as the dashboard controller, may have attacker-supplied script execute in their browsers. Exploitation requires an authenticated attacker to upload a poll-response attachment.
Does exploitation require user interaction?
Yes. A user must view an affected page where the crafted attachment filename is rendered. The attacker does not need to target a browser directly, but must first submit an attachment with a malicious filename.
Which versions are affected and what is the fix?
Omnispace Agora Project versions before 26.10.0 are affected. Upgrade to version 26.10.0 or later.
How can administrators identify possible exposure?
Review poll-response attachments and stored filenames for HTML or script markup, especially where those filenames appear on dashboard or other rendered pages. The issue involves filenames that bypass the sanitization applied to uploaded files.