CVE-2026-71802
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
A stored Cross-Site Scripting (XSS) vulnerability exists in the announcement preview component of REBUILD 4.4.3. Although the announcement content undergoes HTML escaping on the server side, the client-side preview code reverses the escaped entities using jQuery's `html().text()` method and subsequently injects the result into the DOM. An administrator or attacker capable of controlling the announcement content can exploit this vulnerability to execute arbitrary JavaScript code in the browsers of users viewing the affected pages, which may include the dashboard, activity feed, or login page, depending on the announcement's visibility settings.
Risk Assessment
Execution of malicious script in users' browsers can lead to data theft, session hijacking, or malware propagation.
Recommendation
Update REBUILD to a version that safely renders announcement content, and avoid reversing escaping on the client side.
Other vulnerabilities in REBUILD
See all- CVE-2026-102249High
A security flaw has been discovered in REBUILD up to 4.4.11 in unknown code of the /commons/file-editor-save file. Manipulation of the url/fileKey argument results in missing authorization. The attack can be launched remotely and the exploit has been released.
- CVE-2026-102248High
A vulnerability was identified in Rebuild up to 4.4.7/4.5.0-beta5 in an unknown part of the /user/login file of the Login Endpoint component. The manipulation leads to improper authentication. The attack can be initiated remotely and the exploit is publicly available.
- CVE-2024-25294Critical
An SSRF vulnerability in REBUILD v.3.5 allows a remote attacker to obtain sensitive information and execute arbitrary code via the FileDownloader.java, proxyDownload, and URL parameters.
Original NVD description (English source)
A stored Cross-Site Scripting (XSS) vulnerability exists in the announcement preview component of REBUILD 4.4.3. Although the announcement content undergoes HTML escaping on the server side, the client-side preview code reverses the escaped entities using jQuery's `html().text()` method and subsequently injects the result into the DOM. An administrator or attacker capable of controlling the announcement content can exploit this vulnerability to execute arbitrary JavaScript code in the browsers of users viewing the affected pages "which may include the dashboard, activity feed, or login page, depending on the announcement's visibility settings.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS