CVE-2026-33653 Details
Description
Ulloady is a file uploader script with multi-file upload support. A Stored Cross-Site Scripting (XSS) vulnerability exists in versions prior to 3.1.2 due to improper sanitization of filenames during the file upload process. An attacker can upload a file with a malicious filename containing JavaScript code, which is later rendered in the application without proper escaping. When the filename is displayed in the file list or file details page, the malicious script executes in the browser of any user who views the page. Version 3.1.2 fixes the issue.
A stored cross-site scripting vulnerability has been identified in Uploady, a file uploader script, in versions prior to 3.1.2. The issue arises from inadequate sanitization of filenames during the file upload process, allowing an attacker to upload a file with a malicious filename containing JavaScript code. This script is executed in the browser of any user who views the file list or details page where the filename is displayed. The vulnerability could be exploited by uploading a file with a name that includes a script payload, which would then run when the file is accessed through the application interface.
Users can upgrade to Uploady version 3.1.2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/farisc0de/Uploady/commit/e4b4dbec0b45304b5ab01e36a1003d0c7cc613d5 | [email protected] | Patch |
| https://github.com/farisc0de/Uploady/releases/tag/v3.1.2 | [email protected] | ProductRelease Notes |
| https://github.com/farisc0de/Uploady/security/advisories/GHSA-2834-m7xm-fqr5 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| farisc0de uploady | < 3.1.2 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 10, 2026 | Initial Analysis | [email protected] |
| Mar 26, 2026 | New CVE Received | [email protected] |