CVE-2026-107801: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in banq jivejdon

CVE-2026-107801 is a stored cross-site scripting vulnerability in banq's Jivejdon product through version 5.0. The flaw arises because the application improperly neutralizes input during web page generation. Specifically, an authenticated attacker can upload a file with a Content-Type header set to text/html. When the UploadShowAction serves this file inline, it allows execution of arbitrary JavaScript in the security context of the application for users who access the shared link.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the context of the affected application for users who view the maliciously crafted attachment. This can lead to session hijacking, unauthorized actions, or other client-side impacts depending on the application's security context and user privileges. The vulnerability requires authentication and user interaction (clicking the shared link).

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict or monitor file upload Content-Type handling and avoid sharing links to untrusted attachments. Consider applying input validation or output encoding on uploaded file metadata to prevent inline execution.