CVE-2026-35608: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in RoastSlav quickdrop
CVE-2026-35608 is a stored cross-site scripting (XSS) vulnerability in RoastSlav quickdrop versions prior to 1. 5. 3. The flaw exists in the file preview endpoint, where specially crafted SVG files containing JavaScript payloads can be uploaded and executed when previewed by any user. This allows script execution in the context of the application's domain. The vulnerability is fixed in version 1. 5. 3. The CVSS 4. 0 base score is 5.
AI Analysis
Technical Summary
RoastSlav quickdrop before version 1.5.3 contains a stored XSS vulnerability (CWE-79) in its file preview endpoint. Attackers can upload SVG files with embedded JavaScript via the /api/file/upload-chunk endpoint. When a user previews such a file, the malicious script executes within the application's domain context, potentially leading to unauthorized script execution. This vulnerability has been addressed in quickdrop version 1.5.3.
Potential Impact
Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the quickdrop application domain for any user who previews the malicious SVG file. This can lead to session hijacking, unauthorized actions, or other client-side impacts typical of stored XSS vulnerabilities. There are no known exploits in the wild at this time.
Mitigation Recommendations
Upgrade quickdrop to version 1.5.3 or later where this vulnerability is fixed. Since the vendor advisory states the issue is resolved in 1.5.3, applying this official fix is the recommended remediation. No additional mitigation steps are indicated.
CVE-2026-35608: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in RoastSlav quickdrop
Description
CVE-2026-35608 is a stored cross-site scripting (XSS) vulnerability in RoastSlav quickdrop versions prior to 1. 5. 3. The flaw exists in the file preview endpoint, where specially crafted SVG files containing JavaScript payloads can be uploaded and executed when previewed by any user. This allows script execution in the context of the application's domain. The vulnerability is fixed in version 1. 5. 3. The CVSS 4. 0 base score is 5.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
RoastSlav quickdrop before version 1.5.3 contains a stored XSS vulnerability (CWE-79) in its file preview endpoint. Attackers can upload SVG files with embedded JavaScript via the /api/file/upload-chunk endpoint. When a user previews such a file, the malicious script executes within the application's domain context, potentially leading to unauthorized script execution. This vulnerability has been addressed in quickdrop version 1.5.3.
Potential Impact
Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the quickdrop application domain for any user who previews the malicious SVG file. This can lead to session hijacking, unauthorized actions, or other client-side impacts typical of stored XSS vulnerabilities. There are no known exploits in the wild at this time.
Mitigation Recommendations
Upgrade quickdrop to version 1.5.3 or later where this vulnerability is fixed. Since the vendor advisory states the issue is resolved in 1.5.3, applying this official fix is the recommended remediation. No additional mitigation steps are indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-04-03T21:25:12.163Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69d534e5aaed68159a357dca
Added to database: 4/7/2026, 4:46:29 PM
Last enriched: 4/7/2026, 5:01:40 PM
Last updated: 4/7/2026, 6:01:40 PM
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.