CVE-2026-111168: LibreDesk before 2.9.0-rc.8 Stored XSS via SVG Upload Content-Type Parameter
Advisory generated from the CVE record, CISA, Exploit Observer and VEDAS: what it is, whether it is exploited, who is affected, and how to fix and detect it.
Generated by VEDAS. Scores as of 2026-11-04 15:41 UTC. Rebuilt every few hours from cve-scores, CISA KEV and vedas-signatures. How this works and its limits.
What it is
LibreDesk before 2.9.0-rc.8 contains a stored cross-site scripting vulnerability that allows authenticated agents to execute script by uploading SVGs with malformed Content-Type parameters. Attackers can upload an SVG typed ‘image/svg+xml; x’ via /api/v1/media so GET /uploads/{uuid} serves it inline without sandbox, running script in any viewing agent’s or administrator’s session.
Description quoted from the CVE record (assigned by VulnCheck, published 2026-10-15).
Weakness: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
How it can be exploited
Exploitable over the network with low attack complexity with no special attack requirements needing low privileges and a user must take an action. Impact: confidentiality low, integrity low, availability none. CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
CISA assessment (SSVC): CISA has no evidence of exploitation. Automatable: no. Technical impact: partial.
Public exploit evidence (Exploit Observer)
Exploit Observer found 3 code repositories naming this CVE.
Code repositories that name a CVE are often scanners, copies or fakes, and some are malware. Read the code before running anything.
See all 6 references on Exploit Observer
Live scores
- EPSS
- 0.002
low predicted chance of attack - VEDAS
- 0.986
strong exploit evidence - On CISA KEV
- Not listed
- Detection rule
- Suricata
Who is affected
| Product | Affected | Not affected |
|---|---|---|
| abhinavxd libredesk | before 2.9.0-rc.8 | Not stated |
Version ranges exactly as the CVE record states them. “Before X” means X is the first fixed version.
How to fix it
Fixed versions stated in the CVE record: 2.9.0-rc.8.
Vendor guidance:
- https://github.com/abhinavxd/libredesk/pull/641 (patch, issue-tracking)
- https://github.com/abhinavxd/libredesk/commit/ab3a5ca682fcc1caec0950fc607b66caea49bec3 (patch)
- libredesk v2.9.0-rc.8 Release Notes (release-notes)
How to detect it
Suricata rules (network detection)
1 rule that alert on traffic matching this exploit: VEDAS CVE-2026-111168 LibreDesk - Stored XSS via Malformed SVG Content-Type Upload. Add them to your Suricata rule set and reload.
Show the rules
alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"VEDAS CVE-2026-111168 LibreDesk - Stored XSS via Malformed SVG Content-Type Upload"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/api/v1/media"; nocase; fast_pattern; http.request_body; content:"image/svg+xml|3b|"; nocase; pcre:"/image\x2fsvg\x2bxml\x3b[^=\r\n]*(?:\r?\n|--)/i"; classtype:web-application-attack; reference:cve,CVE-2026-111168; reference:url,https://www.exploit.observer/?keyword=CVE-2026-111168&match=exact; reference:url,https://subdomain.center/?engine=ammonites&keyword=libredesk&match=exact; sid:1085600; rev:1;)
CVE-2026-111168.rules on GitHub
References
Vendor advisories and patches
- https://github.com/abhinavxd/libredesk/pull/641 (patch, issue-tracking)
- https://github.com/abhinavxd/libredesk/commit/ab3a5ca682fcc1caec0950fc607b66caea49bec3 (patch)
- libredesk v2.9.0-rc.8 Release Notes (release-notes)
Technical analysis and advisories
- https://github.com/abhinavxd/libredesk/blob/086b08200d667f2cc083635e925d6f5e7b0097e3/cmd/media.go#L255-L272 (technical-description)
- https://github.com/abhinavxd/libredesk/blob/086b08200d667f2cc083635e925d6f5e7b0097e3/internal/media/media.go#L422-L433 (technical-description)
- VulnCheck Advisory: LibreDesk before 2.9.0-rc.8 Stored XSS via SVG Upload Content-Type Parameter (third-party-advisory)
Other references
- https://github.com/abhinavxd/libredesk (product)
Other databases
Where this comes from
This advisory is generated automatically by VEDAS from: CVE.org record, cve-scores (EPSS and VEDAS), Exploit Observer, vedas-signatures. Text in quotes is reproduced from the source; everything else is a fixed template filled with source fields. Nothing here is written by a language model. Check the vendor advisory before acting, and read how VEDAS and Exploit Observer work, and their limits.
Supporting partners
