CVE-2026-45229

HighCVSS 8.8

Published: 13/05/2026(UTC)Updated: 14/07/2026(UTC)Translated: 15/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.37%

29th percentile - higher than 29% of all known CVEs

Summary

A mass assignment vulnerability in Quark Drive before version 0.8.5 in the POST /update endpoint allows authenticated attackers to overwrite administrator credentials by posting an arbitrary webui object to the config_data dictionary. Attackers can exploit insufficient deny-list filtering to permanently replace stored login credentials, lock out legitimate administrators, and gain persistent access to all configured tasks, cloud tokens, and notification services.

Risk Assessment

The risk for the organization includes full compromise of the Quark Drive system, administrator lockout, and access to sensitive data and services, potentially leading to data breaches and service disruption.

Recommendation

Immediately update Quark Drive to version 0.8.5 or later, and review and strengthen input filtering on the POST /update endpoint.

Other vulnerabilities in Quark Drive

CVE-2026-45228Medium
Quark Drive before version 0.8.5 contains a stored cross-site scripting vulnerability in the System Configuration page. The template renders push_config key names using Vue.js's v-html directive without escaping, allowing authenticated attackers to inject HTML or JavaScript payloads via the POST /update endpoint. The injected payload is persisted to disk and executed in the browsers of all authenticated users accessing the System Configuration tab.

Original NVD description (English source)

Quark Drive before 0.8.5 contains a mass assignment vulnerability in the POST /update endpoint that allows authenticated attackers to overwrite administrator credentials by posting an arbitrary webui object to the config_data dictionary. Attackers can exploit insufficient deny-list filtering to permanently replace stored login credentials, lock out legitimate administrators, and gain persistent access to all configured tasks, cloud tokens, and notification services.