CVE-2026-108725 Details

A stored cross-site scripting vulnerability has been identified in the Cheshire Cat AI core application, specifically in versions through 2.0.23. The issue resides within the uploads plugin, which allows authenticated users to upload HTML files via a POST request to the /uploads endpoint, without any restrictions on file type. Once uploaded, attackers can share the public URL of the file with a signed-in victim. When the victim accesses the URL, the uploaded script executes in the context of the application origin, using the victim's access_token cookie. This includes potential execution under an administrator's account.

The vulnerability can be addressed by modifying the file serving response to include a Content-Disposition header that forces the file to be downloaded rather than rendered inline. Additionally, implementing a content type allowlist for uploads and setting a strict Content-Security-Policy can further mitigate the risk.