Jirafeau project vulnerabilities and threats

CVE-2026-1466 is a medium severity cross-site scripting (XSS) vulnerability in the Jirafeau file sharing project. It arises from improper MIME type validation during browser preview of files, allowing attackers to bypass restrictions by sending manipulated HTTP requests with invalid MIME types. This causes browsers to MIME-sniff and potentially execute malicious JavaScript embedded in SVG or HTML files. The vulnerability does not require authentication but needs user interaction to trigger the preview. Although no known exploits are reported in the wild, the vulnerability can lead to limited confidentiality and integrity impacts due to script execution in the victim's browser. The issue can be mitigated by disabling MIME sniffing via the X-Content-Type-Options: nosniff header. European organizations using Jirafeau for file sharing should apply strict content-type validation and ensure security headers are properly configured to prevent exploitation.

Jirafeau normally prevents browser preview for text files due to the possibility that for example SVG and HTML documents could be exploited for cross site scripting. This was done by storing the MIME type of a file and allowing only browser preview for MIME types beginning with image (except for image/svg+xml, see CVE-2022-30110 and CVE-2024-12326), video and audio. However, it was possible to bypass this check by sending a manipulated MIME type containing a comma and an other MIME type like text/html (for example image/png,text/html). Browsers see multiple MIME types and text/html would takes precedence, allowing a possible attacker to do a cross-site scripting attack. The check for MIME types was enhanced to prevent a browser preview when the stored MIME type contains a comma.