CVE-2026-75529: Stored Cross-Site Scripting via MIME-Type Confusion in PDF Downloads of Pandora
Pandora is affected by a stored cross-site scripting vulnerability in the PDF download functionality. The /task-download/<taskid>/.../pdf endpoint verifies that the submitted file is a PDF using Pandora's content-based file-type detection, but previously returned the file using sendfile(task.file.path) without explicitly specifying the MIME type or forcing it to be downloaded as an attachment.
Because Flask determines the response MIME type from the filename when a path is supplied, an attacker could submit a file whose content is recognized by Pandora as a PDF while its filename or extension causes the download endpoint to return it with a different, potentially active MIME type.
A specially crafted PDF/polyglot file could therefore be served inline and interpreted by a victim's browser as HTML or another executable web format. If a victim with access to the submitted analysis follows the PDF download link, attacker-controlled script could execute in the security context of the Pandora application, potentially allowing access to application data or actions using the victim's session.
The patch prevents the issue by explicitly returning PDF downloads with Content-Type: application/pdf, forcing Content-Disposition: attachment, and assigning a trusted .pdf filename based on the task UUID.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the PDF download logic to explicitly set the response header Content-Type to application/pdf (instead of relying on Flask’s inferred MIME type).
Pandora /task-download/<task_id>/.../pdf endpoint Content-Type = application/pdf - Configuration
Update the endpoint to force file download by setting Content-Disposition: attachment (rather than returning the file without forcing download).
Pandora /task-download/<task_id>/.../pdf endpoint Content-Disposition = attachment - Configuration
Update the endpoint to assign a trusted filename ending in .pdf, derived from the task UUID, when returning the downloaded PDF.
Pandora /task-download/<task_id>/.../pdf endpoint download filename = trusted .pdf filename based on task UUID
Event History
Frequently Asked Questions
What is the severity of CVE-2026-75529?
CVE-2026-75529 has a risk score of 52, indicating a moderate severity level.
What type of vulnerability is CVE-2026-75529?
CVE-2026-75529 is a stored cross-site scripting (XSS) vulnerability.
How does CVE-2026-75529 occur?
CVE-2026-75529 occurs via MIME-type confusion in the PDF download functionality of Pandora.
How can I mitigate the risks associated with CVE-2026-75529?
To mitigate CVE-2026-75529, ensure proper validation of file types and avoid relying solely on content-based file-type detection.
What impact can CVE-2026-75529 have on users?
CVE-2026-75529 can potentially allow an attacker to execute malicious scripts in the context of the user’s browser.