XSS in Morelitea Initiative
CVE-2026-28274
Initiative is a self-hosted project management platform. Versions of the application prior to 0.32.4 are vulnerable to Stored Cross-Site Scripting (XSS) in the document upload functionality. Any user with upload permissions within the "Initiatives" section can upload a malicious `.html` or `.htm` file as a document. Because the uploaded HTML file is served under the application's origin without proper sandboxing, the embedded JavaScript executes in the context of the application. As a result, authentication tokens, session cookies, or other sensitive data can be exfiltrated to an attacker-controlled server. Additionally, since the uploaded file is hosted under the application's domain, simply sharing the direct file link may result in execution of the malicious script when accessed. Version 0.32.4 fixes the issue.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.006 (42.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.7 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N.
Affected products
- Morelitea Initiative — versions < 0.32.4
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Exploit, Vendor Advisory)
- security-advisories@github.com (Product, x_refsource_MISC, Release Notes)
Frequently asked questions
- What is CVE-2026-28274?
- CVE-2026-28274 is a high-severity vulnerability in Morelitea Initiative, classified under Cross-site Scripting. CVSS score: 8.7/10. Published 2026-02-26.
- How severe is CVE-2026-28274?
- High severity. CVSS v3 base score is 8.7 out of 10.