PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-9519 stonith404 CVE debrief

A reflected cross-site scripting (XSS) vulnerability exists in Pingvin Share versions up to and including 1.13.0. The flaw resides in the `getServerSideProps` function within `frontend/src/pages/auth/signIn.tsx`, where unsanitized user input passed via the `redirect` parameter is reflected into the page response. An attacker can craft a malicious URL containing JavaScript in the redirect parameter, which executes in the victim's browser when they visit the sign-in page. The vulnerability requires user interaction (clicking a malicious link) and has been publicly disclosed with exploit details available. The vendor was reportedly contacted prior to disclosure but did not respond.

Vendor
stonith404
Product
pingvin-share
CVSS
LOW 2.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-26
Original CVE updated
2026-07-23
Advisory published
2026-05-26
Advisory updated
2026-07-23

Who should care

Organizations self-hosting Pingvin Share instances for internal or external file sharing; security teams monitoring open-source application vulnerabilities; developers implementing authentication flows with redirect parameters

Technical summary

The vulnerability is a reflected XSS in the sign-in auto-redirect functionality of Pingvin Share, an open-source file sharing platform. The `getServerSideProps` Next.js function in `frontend/src/pages/auth/signIn.tsx` reflects the `redirect` query parameter into the page without proper output encoding or validation. This allows injection of arbitrary JavaScript that executes in the context of the victim's session. The attack is delivered via a crafted URL and requires the victim to visit the malicious link. The CVSS 4.0 score of 2.1 (LOW) reflects the user interaction requirement and limited integrity impact, though session hijacking or credential theft remains possible depending on application context.

Defensive priority

P3

Recommended defensive actions

  • Review and sanitize all user-supplied redirect parameters in authentication flows using allowlist-based validation
  • Implement Content Security Policy (CSP) headers to mitigate impact of XSS vulnerabilities
  • Upgrade to Pingvin Share version 1.13.1 or later when available, or apply vendor-provided patches
  • Monitor authentication endpoints for anomalous redirect parameter patterns in web application logs
  • Consider implementing additional redirect validation that ensures destinations match expected application domains

Evidence notes

Vulnerability confirmed via Vuldb entry and associated Gist reference. CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, and user interaction required. CWE-79 (XSS) and CWE-94 (Code Injection) classifications applied by CNA.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-9519 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-9519

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-9519 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-9519

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.