CVE-2026-45229 is a high-severity vulnerability in Quark Drive before version 0.8.5. The vulnerability is caused by a mass assignment issue in the POST /update endpoint, which allows authenticated attackers to overwrite administrator credentials by posting an arbitrary webui object to the config_data dictionary. This can lead to permanent replacement of stored login credentials, locking out legitimate adm [truncated]
CVE-2026-45228 is a stored cross-site scripting vulnerability in Quark Drive before 0.8.5. The vulnerability exists in the System Configuration page, where the template renders push_config key names using Vue.js's v-html directive without escaping. Authenticated attackers can inject HTML or JavaScript payloads as key names through the POST /update endpoint, which are persisted to disk and executed in the [truncated]
