XSS in Morelitea Initiative
CVE-2026-28274
Initiative is a self-hosted project management platform. Versions of the application prior to 0.32.4 are vulnerable to Stored Cross-Site Scripting (XSS) in the document upload functionality. Any user with upload permissions within the "Initiatives" section can upload a malicious `.html` or `.htm` file as a document. Because the uploaded HTML file is served under the application's origin without proper sandboxing, the embedded JavaScript executes in the context of the application. As a result, authentication tokens, session cookies, or other sensitive data can be exfiltrated to an attacker-controlled server. Additionally, since the uploaded file is hosted under the application's domain, simply sharing the direct file link may result in execution of the malicious script when accessed. Version 0.32.4 fixes the issue.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.7 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N.
EPSS exploit prediction
EPSS: 0.006 (44.8th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 45th percentile — 44.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.006 · change: +0.000
Affected products
- Morelitea Initiative — versions < 0.32.4
Weakness classification (CWE)
References
- github.com/Morelitea/initiative/security/advisories/GHSA-v38c-x27x-p584 (Exploit, Vendor Advisory)
- github.com/Morelitea/initiative/releases/tag/v0.32.4 (Product, Release Notes)
Frequently asked questions
- What is CVE-2026-28274?
- CVE-2026-28274 is a high-severity vulnerability in Morelitea Initiative, classified under Cross-site Scripting. CVSS score: 8.7/10. Published 2026-02-26.
- How severe is CVE-2026-28274?
- High severity. CVSS v3 base score is 8.7 out of 10.