PT-2026-22222 · Unknown · Initiative

G3Xar · Publicado 2026-02-26 · Atualizado 2026-03-03 · CVE-2026-28274

Positive Technologies (AI Summary)

CVSS v3.1

8.7

Alta

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Initiative versions prior to 0.32.4

Description Initiative is a self-hosted project management platform vulnerable to Stored Cross-Site Scripting (XSS) in the document upload functionality. Users with upload permissions within the "Initiatives" section can upload malicious .html or .htm files. These files are served under the application’s origin without proper sandboxing, allowing embedded JavaScript to execute in the application’s context. This can lead to the exfiltration of authentication tokens, session cookies, or other sensitive data to an attacker-controlled server. Sharing the direct file link may also result in the execution of the malicious script when accessed.

Recommendations Upgrade to version 0.32.4 or later.

Exploit

Correção

Unrestricted File Upload

XSS

Enumeração de Fraquezas

CWE-434

CWE-79

Identificadores relacionados

CVE-2026-28274

GHSA-V38C-X27X-P584

Produtos afetados

Initiative

Referências · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28274.json · Exploit
• https://github.com/Morelitea/initiative/releases/tag/v0.32.4 · Nota
• https://github.com/Morelitea/initiative/security/advisories/GHSA-v38c-x27x-p584 · Aviso do Fabricante
• https://twitter.com/TheHackerWire/status/2027161994730811710 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2027466632122274007 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-28274 · Nota de Segurança
• https://twitter.com/CveTodo/status/2027166551820882028 · Publicação no Twitter
• https://twitter.com/CveFindCom/status/2027167236935368969 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-28274 · Aviso do Fabricante
• https://twitter.com/pulsepatchio/status/2027754402677686621 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2027175216837804433 · Publicação no Twitter
• https://twitter.com/cracbot/status/2028787701990973599 · Publicação no Twitter