CVE-2026-71881: Cross-site scripting in Integrated Publishing Toolkit
Multiple injection issues in resource metadata fields in GBIF Integrated Publishing Toolkit versions before 3.3.5 allows authenticated remote attackers to execute code in another user's session after user interaction via stored cross-site scripting
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GBIF Integrated Publishing Toolkitto a version that resolves this vulnerability.Fixed in 3.3.5
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to the GBIF Integrated Publishing Toolkit and able to place malicious content in affected resource metadata fields. Exploitation also requires another user to interact with the stored content.
Which deployments are affected?
GBIF Integrated Publishing Toolkit versions before 3.3.5 are affected. The provided information does not state whether any particular default configuration limits access to the vulnerable metadata fields.
What is the impact if exploitation succeeds?
The attacker can execute code in the session of another user who interacts with the malicious stored content. The provided information does not further specify the actions that code could perform.