CVE-2026-45228 Details

A stored cross-site scripting vulnerability has been identified in Quark Drive versions prior to 0.8.5. The issue arises in the System Configuration page, where the application improperly renders key names using Vue.js's v-html directive without proper escaping. This flaw allows authenticated attackers to inject HTML or JavaScript payloads as key names through the POST /update endpoint. The injected payloads are persisted to disk and executed in the browsers of all authenticated users accessing the System Configuration tab. This exploitation can lead to session cookie exfiltration and the ability to perform arbitrary actions on behalf of the authenticated user.

Users can update to Quark Drive version 0.8.6 or later, where this vulnerability has been patched.