CVE-2026-124435

MEDIUM 4.8

OpenRemote before 1.32.2 Stored XSS via Manager Configuration Image Upload

CVSS Score

4.8

EPSS Score

0.0%

EPSS Percentile

0th

OpenRemote before 1.32.2 contains a stored cross-site scripting vulnerability that allows authenticated users with write:admin permissions to upload HTML or SVG files containing JavaScript via the Manager configuration file upload endpoint. Attackers can lure victims to the unauthenticated image retrieval endpoint, which serves files as text/html or image/svg+xml, executing scripts within the application's origin.

CWE	CWE-79
Vendor	openremote
Product	core
Published	Nov 8, 2026

Stay Ahead of the Next One

Get instant alerts for openremote core

Be the first to know when new medium vulnerabilities affecting openremote core are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

openremote / core

0 < 1.32.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/openremote/core/security/advisories/GHSA-vgp4-96p8-3w8v vulncheck.com: https://www.vulncheck.com/advisories/openremote-before-1.32.2-stored-xss-via-manager-configuration-image-upload

Credits

myracknerd-ops tinyb0y