CVE-2026-11569
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
In Quay, the filedrop endpoint accepts any mime type without validation, allowing an authenticated user with repository write access to upload a malicious SVG file containing JavaScript. The file is stored and served inline via CDN, enabling stored XSS.
Risk Assessment
When a victim visits the archive URL, malicious script executes in their browser, potentially leading to data theft or session hijacking.
Recommendation
Implement MIME type validation on the filedrop endpoint and restrict SVG file uploads.
Other vulnerabilities in Quay
See all- CVE-2026-18255High
In Quay, a user configured in GLOBAL_READONLY_SUPER_USERS can view robot account tokens for repositories they are not a member of. This allows an attacker with read-only superuser privileges to impersonate any robot account.
- CVE-2026-10078Low
In the Quay config-tool's GitLab OAuth validator, sensitive credentials (client_id and client_secret) are transmitted as plaintext in URL query parameters during POST requests to the GitLab endpoint. This can lead to disclosure of these credentials in system logs such as server access logs, reverse proxy logs, and other monitoring systems.
- CVE-2025-4374Medium
A flaw was found in Quay where when an organization acts as a proxy cache, and a user or robot pulls an image that hasn't been mirrored yet, they are granted 'Admin' permissions on the newly created repository.
Original NVD description (English source)
A flaw was found in Quay. The filedrop endpoint accepts any mime type without validation, allowing an authenticated user with repository write access to upload a malicious SVG file containing JavaScript. The file is stored and served inline through the CDN, enabling stored cross-site scripting when a victim visits the archive URL.