PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-75529 pandora-analysis CVE debrief

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-17T21:16:58.923Z and has not been modified since then. The NVD entry is currently Awaiting Analysis. The vulnerability is a stored cross-site scripting (XSS) issue in Pandora's PDF download functionality. An attacker could submit a specially crafted PDF/polyglot file that can be served inline and interpreted by a victim's browser as HTML or another executable web format, allowing attacker-controlled script to execute in the security context of the Pandora application. Security teams and administrators responsible for Pandora instances should review and update the PDF download endpoint to prevent potential XSS attacks. Users with access to submitted analyses in Pandora should exercise caution when following PDF download links. The patch prevents the issue by explicitly returning PDF downloads with Content-Type: application/pdf, forcing Content-Disposition: attachment, and assigning a trusted .pdf filename based on the task UUID. To address this vulnerability, it is recommended to review and update the PDF download endpoint to ensure proper MIME type handling, implement Content-Type and Content-Disposition headers for PDF downloads, verify and enforce trusted filename assignments for PDF downloads, conduct thorough inventory checks for Pandora instances, and monitor for suspicious activity. Consider compensating controls such as web application firewalls.

Vendor
pandora-analysis
Product
pandora
CVSS
MEDIUM 6.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-17
Original CVE updated
2026-08-26
Advisory published
2026-08-17
Advisory updated
2026-08-26

Who should care

Security teams and administrators responsible for Pandora instances should review and update the PDF download endpoint to prevent potential XSS attacks. Users with access to submitted analyses in Pandora should exercise caution when following PDF download links.

Technical summary

The /task-download/<task_id>/.../pdf endpoint in Pandora verifies that the submitted file is a PDF using content-based file-type detection but previously returned the file without explicitly specifying the MIME type or forcing it to be downloaded as an attachment. An attacker could submit a file whose content is recognized as a PDF while its filename or extension causes the download endpoint to return it with a different, potentially active MIME type. A specially crafted PDF/polyglot file could be served inline and interpreted by a victim's browser as HTML or another executable web format, allowing attacker-controlled script to execute in the security context of the Pandora application.

Defensive priority

Medium-priority defensive review recommended due to potential for XSS attacks

Recommended defensive actions

  • Review and update PDF download endpoint to ensure proper MIME type handling
  • Implement Content-Type and Content-Disposition headers for PDF downloads
  • Verify and enforce trusted filename assignments for PDF downloads
  • Conduct thorough inventory checks for Pandora instances and monitor for suspicious activity
  • Consider compensating controls such as web application firewalls

Evidence notes

Evidence from official CVE and NVD sources indicates a stored cross-site scripting vulnerability in Pandora's PDF download functionality. The vulnerability allows an attacker to submit a specially crafted PDF/polyglot file that can be served inline and interpreted by a victim's browser as HTML or another executable web format.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-75529 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-75529

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-75529 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-75529

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://github.com/pandora-analysis/pandora/commit/668ec65a93cee327e3d925da2698849c9e65625a

    5a6e4751-2f3f-4070-9419-94fb35b644e8

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.