CVE-2026-63148: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Omnispace Agora Project

Omnispace Agora Project prior to version 26.10.0 contains a stored XSS vulnerability due to improper neutralization of input during web page generation. Authenticated attackers can upload a poll-response attachment with a malicious filename that bypasses the paramFilter sanitization applied to $_FILES. The malicious filename is stored and subsequently rendered in components such as the dashboard controller (CtrlDashboard), enabling execution of arbitrary scripts in the browsers of users viewing the affected page.

Successful exploitation allows authenticated attackers to execute arbitrary scripts in the browsers of users who view the affected dashboard page. This can lead to session hijacking, defacement, or other script-based attacks within the context of the affected application. The vulnerability requires authentication and user interaction (viewing the affected page).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict file upload permissions to trusted users and consider additional input validation or sanitization controls on uploaded filenames. Monitor for updates from Omnispace regarding an official fix.