This vulnerability in Red Hat Quay 3 involves improper neutralization of input during web page generation. Specifically, the filedrop endpoint accepts any MIME type without validation, enabling an authenticated user with repository write permissions to upload a malicious SVG file embedding JavaScript code. The malicious file is stored and served inline through the CDN, which results in stored cross-site scripting when a user visits the affected archive URL. The CVSS 3.1 base score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, required privileges, and user interaction with partial confidentiality and integrity impact. No patch or remediation level has been provided by Red Hat as of the published date.

An authenticated user with repository write access can upload a malicious SVG file containing JavaScript that is stored and served inline. This enables stored cross-site scripting attacks against users who visit the archive URL, potentially leading to partial confidentiality and integrity compromise. There is no indication of availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-11569 for current remediation guidance. Until a fix is available, restrict repository write access to trusted users only and consider monitoring for suspicious SVG uploads. Avoid visiting archive URLs from untrusted sources. Follow vendor updates for official patches or workarounds.