Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently sanitize input used by the Query Console… (CVE-2026-85976)

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not properly sanitize input used by the Query Console file-exploration endpoint. This insufficient input sanitization can lead to HTTP response splitting attacks, which may result in unintended client-side response handling. The vulnerability is identified as CWE-113 and has a CVSS v3.1 base score of 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), indicating network attack vector, low attack complexity, requires privileges and user interaction, with partial impact on confidentiality and integrity but no impact on availability.

Successful exploitation could allow an attacker with some privileges and requiring user interaction to manipulate HTTP responses via the Query Console, potentially causing unintended client-side behavior such as response splitting. The impact affects confidentiality and integrity partially but does not affect availability.

A fix is available in Progress MarkLogic Server versions 12.1.0 and 11.3.7 and later. Users should upgrade to these or later versions to remediate this vulnerability. Patch status is confirmed by the version information indicating fixed versions. No additional vendor advisory content was provided, so users should consult official Progress MarkLogic advisories for detailed remediation instructions.