CVE-2026-25739

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Versions prior to 3.3.10 are vulnerable to cross-site scripting when uploading certain file types as materials. Users should upgrade to version 3.3.10 to receive a patch. To apply the fix itself updating is sufficient, but to benefit from the strict Content Security Policy (CSP) Indico now applies by default for file downloads, update the webserver config in case one uses nginx with Indico's `STATIC_FILE_METHOD` set to `xaccelredirect`. For further directions, consult the GitHub Security advisory or Indico setup documentation. Some workarounds are available. Use the webserver config to apply a strict CSP for material download endpoints, and/or only let trustworthy users create content (including material uploads, which speakers can typically do as well) on Indico.

• CWE-79

• https://github.com/indico/indico/releases/tag/v3.3.10Release Notes
• https://github.com/indico/indico/security/advisories/GHSA-jxc4-54g3-j7vpPatch, Vendor Advisory

Published

Feb 19, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-25733Rucio is a software framework that provides functionality to…5.4
• CVE-2026-25734Rucio is a software framework that provides functionality to…4.8
• CVE-2026-25735Rucio is a software framework that provides functionality to…4.8
• CVE-2026-25736Rucio is a software framework that provides functionality to…4.8
• CVE-2026-25737Budibase is a low code platform for creating internal tools,…9
• CVE-2026-25738Indico is an event management system that uses Flask-Multipa…4.3
• CVE-2026-25740captive browser, a dedicated Chrome instance to log into cap…5.8
• CVE-2026-25741Zulip is an open-source team collaboration tool. Prior to co…7.1
• CVE-2026-25742Zulip is an open-source team collaboration tool. Prior to ve…5.3
• CVE-2026-25743OpenEMR is a free and open source electronic health records …4.8
• CVE-2026-25744OpenEMR is a free and open source electronic health records …6.5
• CVE-2026-25745OpenEMR is a free and open source electronic health records …6.5