CVE-2026-11569

5.4 Moyenne

Publiée le 08/06/2026 à 14:16 · Modifiée le 23/07/2026 à 09:10 · En attente d'analyse NVD · Source : secalert@redhat.com

Description

A flaw was found in Quay. The filedrop endpoint accepts any mime type without validation, allowing an authenticated user with repository write access to upload a malicious SVG file containing JavaScript. The file is stored and served inline through the CDN, enabling stored cross-site scripting when a victim visits the archive URL.

Traduire en français

Produits concernés

Red Hat Quay 3

Scores CVSS

Version	Score	Source	Vecteur
3.1	5.4 Moyenne	secalert@redhat.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N`

Faiblesses (CWE)

CWE-79

Références

https://access.redhat.com/security/cve/CVE-2026-11569
https://bugzilla.redhat.com/show_bug.cgi?id=2486194

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories