GHSA-2w4v-r3v4-f5h4: SunEditor before 3.4.0 Stored XSS via FileUpload Plugin Filename

Q: Which deployments should be considered affected?

SunEditor versions before 3.4.0 are affected where the FileUpload plugin is used. The issue is triggered by server-returned file names processed by that plugin.

Q: What does an attacker need to exploit this issue?

The attacker needs the ability to upload a file with an HTML-laden filename. The malicious filename executes when a victim loads the affected content or gallery item.

Q: What is the likely impact of successful exploitation?

JavaScript can run in a victim's browser in the context of the affected application. The advisory identifies session theft as a possible outcome.

Published Nov 8, 2026

Updated

SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the FileUpload plugin create() method that assigns server-returned file names to innerHTML without escaping. Attackers can upload files with HTML-laden names that bypass html.clean() and execute JavaScript in victims' browsers when content or gallery items load, enabling session theft.

Affected Software

1 affected component

SunEditor SunEditor<3.4.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade SunEditor to a version that resolves this vulnerability.
Fixed in 3.4.0

Event History

Nov 8, 2026

CVE Published

via OSV·01:16 PM

Data Sourced

via OSV·01:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments should be considered affected?

SunEditor versions before 3.4.0 are affected where the FileUpload plugin is used. The issue is triggered by server-returned file names processed by that plugin.

What does an attacker need to exploit this issue?

The attacker needs the ability to upload a file with an HTML-laden filename. The malicious filename executes when a victim loads the affected content or gallery item.

What is the likely impact of successful exploitation?

JavaScript can run in a victim's browser in the context of the affected application. The advisory identifies session theft as a possible outcome.

GHSA-2w4v-r3v4-f5h4: SunEditor before 3.4.0 Stored XSS via FileUpload Plugin Filename

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments should be considered affected?

What does an attacker need to exploit this issue?

What is the likely impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments should be considered affected?

What does an attacker need to exploit this issue?

What is the likely impact of successful exploitation?