CVE-2026-35608: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in RoastSlav quickdrop
QuickDrop is an easy-to-use file sharing application. Prior to 1.5.3, a stored XSS vulnerability exists in the file preview endpoint. The application allows SVG files to be uploaded via the /api/file/upload-chunk endpoint. An attacker can upload a specially crafted SVG file containing a JavaScript payload. When any user views the file preview, the script executes in the context of the application's domain. This vulnerability is fixed in 1.5.3.
AI Analysis
Technical Summary
RoastSlav quickdrop before version 1.5.3 contains a stored XSS vulnerability (CWE-79) in its file preview endpoint. Attackers can upload SVG files with embedded JavaScript via the /api/file/upload-chunk endpoint. When a user previews such a file, the malicious script executes within the application's domain context, potentially leading to unauthorized script execution. This vulnerability has been addressed in quickdrop version 1.5.3.
Potential Impact
Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the quickdrop application domain for any user who previews the malicious SVG file. This can lead to session hijacking, unauthorized actions, or other client-side impacts typical of stored XSS vulnerabilities. There are no known exploits in the wild at this time.
Mitigation Recommendations
Upgrade quickdrop to version 1.5.3 or later where this vulnerability is fixed. Since the vendor advisory states the issue is resolved in 1.5.3, applying this official fix is the recommended remediation. No additional mitigation steps are indicated.
CVE-2026-35608: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in RoastSlav quickdrop
Description
QuickDrop is an easy-to-use file sharing application. Prior to 1.5.3, a stored XSS vulnerability exists in the file preview endpoint. The application allows SVG files to be uploaded via the /api/file/upload-chunk endpoint. An attacker can upload a specially crafted SVG file containing a JavaScript payload. When any user views the file preview, the script executes in the context of the application's domain. This vulnerability is fixed in 1.5.3.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
RoastSlav quickdrop before version 1.5.3 contains a stored XSS vulnerability (CWE-79) in its file preview endpoint. Attackers can upload SVG files with embedded JavaScript via the /api/file/upload-chunk endpoint. When a user previews such a file, the malicious script executes within the application's domain context, potentially leading to unauthorized script execution. This vulnerability has been addressed in quickdrop version 1.5.3.
Potential Impact
Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the quickdrop application domain for any user who previews the malicious SVG file. This can lead to session hijacking, unauthorized actions, or other client-side impacts typical of stored XSS vulnerabilities. There are no known exploits in the wild at this time.
Mitigation Recommendations
Upgrade quickdrop to version 1.5.3 or later where this vulnerability is fixed. Since the vendor advisory states the issue is resolved in 1.5.3, applying this official fix is the recommended remediation. No additional mitigation steps are indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-04-03T21:25:12.163Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69d534e5aaed68159a357dca
Added to database: 4/7/2026, 4:46:29 PM
Last enriched: 4/7/2026, 5:01:40 PM
Last updated: 5/22/2026, 10:03:40 PM
Views: 87
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.