CVE-2026-72583: fastschema - Stored Cross-Site Scripting via MIME Type Bypass in File Upload
A stored cross-site scripting (XSS) vulnerability in fastschema through v0.15.1 allows a low-privileged authenticated user to upload an SVG file containing malicious JavaScript by bypassing the MIME type allow-list check.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72583?
The severity of CVE-2026-72583 is classified as medium with a score of 5.4.
How do I fix CVE-2026-72583?
To fix CVE-2026-72583, ensure to validate and sanitize file uploads, particularly for SVG files, to prevent any malicious JavaScript.
Who is affected by CVE-2026-72583?
CVE-2026-72583 affects applications using fastschema versions up to v0.15.1 where low-privileged authenticated users can exploit the vulnerability.
What type of vulnerability is CVE-2026-72583?
CVE-2026-72583 is a stored cross-site scripting (XSS) vulnerability.
What are the potential impacts of CVE-2026-72583?
The potential impacts of CVE-2026-72583 include executing malicious scripts in the context of a user's session, leading to unauthorized actions and data leakage.