CVE-2026-45228
Last modified
CVE-2026-45228 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. Quark Drive before 0.8.5 contains a stored cross-site scripting vulnerability in the System Configuration page where the template renders push_config key names using Vue.js's v-html directive without escaping. Authenticated attackers can inject HTML or JavaScript payloads as key names through the POST /update endpoint, which are persisted to disk and executed in the browsers of all authenticated users accessing the System Configuration tab, allowing session cookie exfiltration and arbitrary authenticated actions.. EPSS estimates a 0.18% chance of exploitation in the next 30 days.
Description
Quark Drive before 0.8.5 contains a stored cross-site scripting vulnerability in the System Configuration page where the template renders push_config key names using Vue.js's v-html directive without escaping. Authenticated attackers can inject HTML or JavaScript payloads as key names through the POST /update endpoint, which are persisted to disk and executed in the browsers of all authenticated users accessing the System Configuration tab, allowing session cookie exfiltration and arbitrary authenticated actions.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:L
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-45228?
How severe is CVE-2026-45228?
How do I fix CVE-2026-45228?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-45222Summarize versions through 0.14.1, fixed in commit 0cfb0fb, …6.9
- CVE-2026-45223Crabbox before 0.9.0 contains an authentication bypass vulne…8.8
- CVE-2026-45224Crabbox before 0.9.0 contains a path traversal vulnerability…7.1
- CVE-2026-45225Heym before 0.0.21 contains a path traversal vulnerability i…7.6
- CVE-2026-45226Heym before 0.0.21 contains an authorization bypass vulnerab…7.6
- CVE-2026-45227Heym before 0.0.21 contains a sandbox escape vulnerability i…8.8
- CVE-2026-45229Quark Drive before 0.8.5 contains a mass assignment vulnerab…8.8
- CVE-2026-45230DumbAssets through 1.0.11 contains a path traversal vulnerab…9.1
- CVE-2026-45231DumbAssets through 1.0.11 contains a stored cross-site scrip…6.1
- CVE-2026-45232Rsync versions before 3.4.3 contain an off-by-one out-of-bou…3.7
- CVE-2026-45233HTMLy CMS through 3.1.1 contains a path traversal vulnerabil…8.1
- CVE-2026-4524GitLab has remediated an issue in GitLab CE/EE affecting all…6.5
Are you affected by CVE-2026-45228?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST