CVE-2026-28274 Details

A stored cross-site scripting vulnerability has been identified in the Morelitea Initiative project management platform, affecting versions prior to 0.32.4. The issue arises in the document upload feature within the 'Initiatives' section, where users with upload permissions can introduce malicious HTML files. These files are served from the application's domain without adequate sandboxing, allowing embedded JavaScript to execute in the application's context. This exploitation can lead to the theft of authentication tokens, session cookies, and other sensitive information, which could be sent to an attacker-controlled server. Furthermore, simply sharing the link to the uploaded file can trigger the execution of the malicious script when accessed.

Users can update to Morelitea Initiative version 0.32.4, which addresses this vulnerability by implementing proper content security policies and invalidating JWT tokens on logout.