PT-2026-20993 · Flare · Flare

G3Xar · Publicado 2026-02-20 · Atualizado 2026-03-03 · CVE-2026-26993

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Flare versions 1.7.0 and below

Description Flare, a Next.js-based file sharing platform, is susceptible to a stored Cross-Site Scripting (XSS) issue. The platform does not properly validate or sanitize uploaded files. An attacker can embed malicious JavaScript within an SVG, HTML, or XML file. When a user views the file in “raw” mode, the embedded script executes in the application's context, potentially allowing for the exfiltration of user data. The vulnerability occurs due to insufficient content validation during file uploads.

Recommendations Update to Flare version 1.7.1 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-26993

GHSA-Q8FP-W6M5-4GJM

Produtos afetados

Flare

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26993.json · Exploit
• https://github.com/FlintSH/Flare/security/advisories/GHSA-q8fp-w6m5-4gjm · Aviso do Fabricante
• https://github.com/FlintSH/Flare/commit/7763d7b954799552f287ab9260bb1353f8880163 · Correção
• https://github.com/FlintSH/Flare/releases/tag/v1.7.1 · Nota
• https://osv.dev/vulnerability/CVE-2026-26993 · Aviso do Fabricante
• https://t.me/cveNotify/153995 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-26993 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2024829860716093847 · Publicação no Twitter
• https://t.me/CVEtracker/45237 · Publicação no Telegram