CVE-2026-129430

MEDIUM 5.4

axeloz filesharing before 2.14.3 Stored XSS via Bundle Description Markdown Links

CVSS Score

5.4

EPSS Score

0.0%

EPSS Percentile

0th

Axeloz Filesharing before 2.14.3 contains a stored cross-site scripting vulnerability that allows authenticated users to inject script by storing raw HTML or javascript: Markdown links in bundle descriptions. Recipients viewing the public bundle preview page execute the script via Alpine x-html, letting attackers steal the owner_token from localStorage and issue owner-scoped requests against victim bundles.

CWE	CWE-79
Vendor	axeloz
Product	filesharing
Published	Nov 14, 2026

Stay Ahead of the Next One

Get instant alerts for axeloz filesharing

Be the first to know when new medium vulnerabilities affecting axeloz filesharing are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

axeloz / filesharing

0 < 2.14.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/axeloz/filesharing/commit/eebc80a77c0e3fe3b8467245ba89fa49f2d35928 github.com: https://github.com/axeloz/filesharing/commit/366ee452aba636858d55b82068ecc35f6d08b6d6 github.com: https://github.com/axeloz/filesharing/pull/90 github.com: https://github.com/axeloz/filesharing/blob/e865be1f09f8eb5a46c4b9a16635de892b093d8f/app/Http/Resources/BundleResource.php#L33 github.com: https://github.com/axeloz/filesharing/releases/tag/2.14.3 github.com: https://github.com/axeloz/filesharing vulncheck.com: https://www.vulncheck.com/advisories/axeloz-filesharing-before-2.14.3-stored-xss-via-bundle-description-markdown-links

Credits

Raqin Al-Asraar axeloz