CVE-2026-111168
MediumCVSS 5.4Summary
LibreDesk before 2.9.0-rc.8 contains a stored cross-site scripting vulnerability that allows authenticated agents to execute script by uploading SVGs with malformed Content-Type parameters. Attackers can upload an SVG typed 'image/svg+xml; x' via /api/v1/media so GET /uploads/{uuid} serves it inline without sandbox, running script in any viewing agent's or administrator's session.
Risk Assessment
Stored XSS can lead to session takeover of agents and administrators, data theft, or actions performed on their behalf.
Recommendation
Upgrade LibreDesk to 2.9.0-rc.8 or later and consider enforcing Content-Disposition: attachment for uploaded files.
Other vulnerabilities in LibreDesk
See all- CVE-2026-26957Low risk· EPSS 19%
CVE-2026-26957 has been rejected as the behavior described in the CVE record is intended. The Libredesk application is a single-tenant application, and configuring webhook URLs requires admin-only permissions that are not granted by default.
- CVE-2025-68927Medium
LibreDesk prior to version 0.8.6-beta is vulnerable to stored HTML injection in the contact notes feature. An attacker can inject arbitrary HTML elements such as forms and images, which are stored and rendered without proper sanitization.
Original NVD description (English source)
LibreDesk before 2.9.0-rc.8 contains a stored cross-site scripting vulnerability that allows authenticated agents to execute script by uploading SVGs with malformed Content-Type parameters. Attackers can upload an SVG typed 'image/svg+xml; x' via /api/v1/media so GET /uploads/{uuid} serves it inline without sandbox, running script in any viewing agent's or administrator's session.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS