CVE-2026-63147 Details
Description
Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious script by uploading a file with HTML/script markup embedded in its filename, which bypasses the paramFilter since uploaded-file names arrive through $_FILES rather than $_GET/$_POST. Attackers can upload a file with a crafted name such as an SVG onload payload to have the unsanitized filename stored and later rendered to other users, resulting in script execution in their browsers.
A stored cross-site scripting vulnerability has been identified in Omnispace Agora Project versions prior to 26.10.0. This vulnerability allows authenticated users to inject malicious scripts by uploading files with HTML or script markup embedded in the filename. The issue arises because uploaded file names are processed through the $_FILES superglobal, bypassing the paramFilter that typically sanitizes input from $_GET and $_POST. Attackers can exploit this by, for example, uploading a file with a crafted name that includes an SVG onload payload. The unsanitized filename is then stored and later rendered to other users, executing the script in their browsers.
Users can update to Omnispace Agora Project version 26.10.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 13, 2026CISA-ADP
Assessed Oct 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/xech/agora-project/releases/tag/26.10 | [email protected] | Release NotesVendor |
| https://www.agora-project.net/ | [email protected] | Vendor |
| https://www.vulncheck.com/advisories/omnispace-agora-project-stored-xss-via-uploaded-file-name | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Omnispace Agora Project | < 26.10.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 17, 2026 | CVE Modified | CISA-ADP |
| Oct 13, 2026 | New CVE Received | [email protected] |