CVE-2026-63147: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Omnispace Agora Project

Omnispace Agora Project before version 26.10.0 contains a stored XSS vulnerability where authenticated users can upload files with crafted filenames containing HTML/script markup. These filenames bypass the paramFilter since they are received via $_FILES rather than $_GET/$_POST. The unsanitized filename is stored and later rendered to other users, enabling execution of malicious scripts in their browsers. This vulnerability is identified as CVE-2026-63147 with a CVSS 4.0 base score of 5.1 (medium severity).

An attacker with authenticated access can inject malicious scripts via crafted filenames of uploaded files. These scripts execute in the browsers of other users viewing the affected filenames, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability requires authentication and user interaction (UI:P), and the attack complexity is low (AC:L).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict file upload permissions to trusted users only and consider implementing additional server-side sanitization of uploaded filenames to neutralize script content.