CVE-2026-67444: Hubleys: Stored XSS via unrestricted background-image upload, served with an attacker-chosen Content-Type and no CSP protection
Hubleys is a dashboard for self-hosted services. Prior to version 0.5.2, any authenticated (non-admin) Hubleys user can upload a file with an arbitrary extension as their dashboard "background image," and the server will later serve that file back with a Content-Type derived straight from the attacker's chosen extension - so uploading an .html file gets it served as text/html. Because the endpoint that serves it returns a manually-constructed response rather than going through SvelteKit's normal page-rendering pipeline, the app's configured Content-Security-Policy never gets attached to it either, so a script embedded in the upload runs unrestricted. This issue has been patched in version 0.5.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.5.2
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Hubleys user, including a non-admin user, can upload a malicious file as their dashboard background image. Exploitation therefore requires an account rather than unauthenticated access.
What must an attacker do to trigger script execution?
The attacker uploads a file such as an .html file as a background image, causing it to be served as text/html. A victim must later load the uploaded file for the embedded script to execute.
Are default CSP protections effective for the uploaded file endpoint?
No. The file-serving endpoint constructs its response manually and does not attach Hubleys' configured Content-Security-Policy, so scripts in an uploaded HTML file can run without that CSP protection.
Which versions are affected, and what version fixes the issue?
Versions prior to 0.5.2 are affected. The issue is patched in Hubleys version 0.5.2.