CVE-2018-10208: Vaultize Enterprise File Sharing
Source CVE Database V5
Not known to be exploited.
Data as of 26 Oct 2026, 13:47 UTC
Rated Medium by the CNA (mitre) · No CVSS score from NVD or the CNA
- EPSS
- 0.7% chance of exploitation in 30 days – higher than 55% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Exploitation evidence
Disclosed: evidence found.
CVE published 25 Apr 2018
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| n/a n/a | Affected
| Fixed in– |
AI-suggested
To mitigate this vulnerability, European organizations should first verify if they are running the affected version (17.05.31) of Vaultize Enterprise File Sharing and seek any vendor patches or updates addressing this issue. In the absence of official patches, organizations should implement web application firewall (WAF) rules to detect and block malicious payloads targeting the /share/error endpoint with suspicious 'message' parameters. Input validation and output encoding should be enforced on the error page to sanitize user-supplied input and prevent script injection. Additionally, security teams should educate users about the risks of clicking on unsolicited or suspicious links and encourage the use of browser security features that can mitigate XSS attacks, such as Content Security Policy (CSP). Regular security assessments and penetration testing should be conducted to identify and remediate similar vulnerabilities. Monitoring logs for unusual access patterns to the error page can help detect exploitation attempts early.
Description
An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. There is anonymous reflected XSS on the error page via a /share/error?message= URI.