CVE-2018-10206: Vaultize Enterprise File Sharing
Source CVE Database V5
Not known to be exploited.
Data as of 26 Oct 2026, 17:16 UTC
Rated High by the CNA (mitre) · No CVSS score from NVD or the CNA
- EPSS
- 0.6% chance of exploitation in 30 days – higher than 48% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Exploitation evidence
Disclosed: evidence found.
CVE published 25 Apr 2018
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| n/a n/a | Affected
| Fixed in– |
AI-suggested
To mitigate this vulnerability, organizations should first apply any available patches or updates from Vaultize that address the Stored XSS issue. Input validation and output encoding should be enforced on the optional message field to sanitize user input and prevent script injection. Web Application Firewalls (WAFs) can be configured to detect and block common XSS attack patterns targeting the file request endpoint. User education on phishing and suspicious links is also important since attackers may leverage XSS to deliver malicious payloads. Regular security assessments and penetration testing of the Vaultize deployment can help identify residual risks. Monitoring logs for unusual activity related to file requests or user sessions can provide early detection of exploitation attempts. Finally, organizations should review and enforce least privilege access controls to limit the potential damage from compromised accounts.
Description
An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. There is Stored XSS via the optional message field of a file request.