abhinavxd CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM abhinavxd CVE published 2026-10-15

CVE-2026-111168

LibreDesk before 2.9.0-rc.8 contains a stored cross-site scripting vulnerability that allows authenticated agents to execute script by uploading SVGs with malformed Content-Type parameters. The vulnerability can be exploited through the /api/v1/media endpoint, which serves the SVG inline without sandboxing when accessed via GET /uploads/{uuid}. This issue requires verification of user upload validation an [truncated]