CVE-2026-14856 is a stored XSS vulnerability in TastyIgniter v4.3.0's Media Manager file upload feature. The issue is due to inadequate validation and sanitization of SVG files, enabling authenticated low-privilege users to upload SVGs with embedded JavaScript. When administrators view these files, the malicious script executes in their browser, which can be chained with CSRF attacks to steal CSRF tokens and perform unauthorized administrative operations, including credential modification and full admin account takeover.

An attacker with low privileges can upload malicious SVG files that execute arbitrary JavaScript in the administrator's browser context. This can lead to theft of CSRF tokens and unauthorized administrative actions, including modification of credentials and full control over the administrative account. The vulnerability thus poses a significant risk to the integrity and control of the affected system.

No official patch or remediation is currently available for this vulnerability. Users should monitor the vendor's advisory for updates and apply any official fixes once released. Until then, restrict file upload permissions to trusted users only and avoid viewing uploaded SVG files in administrative contexts. Consider implementing additional input validation or sanitization controls at the application or web server level to mitigate risk.