CVE-2026-63148
CVE-2026-63148
Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject HTML/script markup by uploading a poll-response attachment with a malicious filename that bypasses the paramFilter sanitization applied to $_FILES. Attackers can submit a crafted filename that is stored and later rendered in components such as the dashboard controller (CtrlDashboard), executing arbitrary script in the browsers of users who view the affected page.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Weakness classification (CWE)
References
- github.com/xech/agora-project/releases/tag/26.10 (release-notes, patch)
- www.agora-project.net/ (product)
- www.vulncheck.com/advisories/omnispace-agora-project-stored-xss-via-poll-respon… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-63148?
- CVE-2026-63148 is a medium-severity vulnerability, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2026-10-13.
- How severe is CVE-2026-63148?
- Medium severity. CVSS v3 base score is 5.4 out of 10.