CVE-2026-111168: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in abhinavxd libredesk

CVE-2026-111168 is a stored cross-site scripting vulnerability in LibreDesk prior to version 2.9.0-rc.8. The flaw allows authenticated users to upload SVG files with a malformed Content-Type header (e.g., 'image/svg+xml; x') via the /api/v1/media endpoint. When these SVGs are accessed through GET /uploads/{uuid}, they are served inline without sandbox restrictions, enabling execution of arbitrary scripts in the context of any agent or administrator viewing the file. This improper neutralization of input during web page generation can lead to session hijacking or other script-based attacks.

An authenticated attacker can execute arbitrary scripts in the browsers of agents or administrators who view the malicious SVG files. This can lead to session hijacking, unauthorized actions, or information disclosure within the affected LibreDesk environment. The vulnerability requires authentication and user interaction (viewing the SVG), and the CVSS 4.0 score rates it as medium severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict upload permissions to trusted users only and avoid viewing untrusted SVG uploads. Monitor for updates from the LibreDesk project regarding patches addressing this vulnerability.