CVE-2026-111168 abhinavxd CVE debrief

Who should care

LibreDesk administrators and users with upload privileges should assess exposure and prioritize updating to version 2.9.0-rc.8 or later. They should also restrict SVG uploads to trusted users, implement Content-Type validation for uploaded SVGs, and monitor for suspicious SVG uploads and script execution. Additionally, they should review compensating controls for exposed systems while remediation is scheduled and verified, and check relevant monitoring,

Why it matters

CVE-2026-111168 is a stored cross-site scripting vulnerability in LibreDesk before 2.9.0-rc.8 that allows authenticated agents to execute script by uploading SVGs with malformed Content-Type parameters. Defenders should prioritize updating to version 2.9.0-rc.8 or later, restrict SVG uploads to trusted users, and implement Content-Type validation. The vulnerability requires verification of user upload validation and Content-Type parameter sanitization.

• Authenticated users can execute script in the context of other users' sessions
• Successful exploitation requires user interaction with the uploaded SVG
• The vulnerability can be used to perform actions on behalf of the authenticated user
• Verification of user upload validation and Content-Type parameter sanitization is required

Technical summary

The vulnerability allows authenticated agents to execute script by uploading SVGs with malformed Content-Type parameters via /api/v1/media, which serves the SVG inline without sandboxing when accessed via GET /uploads/{uuid}. This issue requires verification of user upload validation and Content-Type parameter sanitization. The vulnerability can be used to perform actions on behalf of the authenticated user. Successful exploitation requires user interaction with the uploaded SVG. Verification of user upload validation and Content-Type parameter sanitization is required.

Defensive priority

Medium priority for LibreDesk instances with untrusted user uploads

Recommended defensive actions

• Update LibreDesk to version 2.9.0-rc.8 or later
• Restrict SVG uploads to trusted users
• Implement Content-Type validation for uploaded SVGs
• Monitor for suspicious SVG uploads and script execution
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability, but additional testing and verification are required to confirm the scope of affected versions and potential impact. The vulnerability allows authenticated agents to execute script by uploading SVGs with malformed Content-Type parameters via /api/v1/media, which serves the SVG inline without sandboxing when accessed via GET /uploads/{uuid}. Defenders should verify user upload validation and Content-Type parameter sanitization, and consider restricting SVG uploads to

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.