CVE-2026-82838: Default webserver configuration with incorrect CSP
The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content. A valid Content Security Policy is now set.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Replace the default webserver configuration with incorrect CSP by setting a valid Content Security Policy so uploaded SVG files cannot be delivered with executable JavaScript content.
Venueless web server (default Docker image) Content Security Policy (CSP) = Valid CSP
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments using the default Venueless Docker image webserver configuration are exposed if they serve uploaded SVG files. The issue concerns SVG content that can be delivered with executable JavaScript.
What is required for exploitation?
An attacker would need a way to upload an SVG containing executable JavaScript and have that uploaded file delivered by the affected webserver configuration.
What configuration change addresses the issue?
Use a valid Content Security Policy for delivered uploaded SVG files. The advisory states that a valid CSP is now set.