PT-2026-3867 · Saleor · Saleor

Lukasz-Rybak · Publicado 2026-01-21 · Atualizado 2026-01-21 · CVE-2026-23499

Positive Technologies (AI Summary)

CVSS v4.0

8.5

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Saleor versions 3.0.0 through 3.20.107 Saleor versions 3.21.0 through 3.21.42 Saleor versions 3.22.0 through 3.22.26

Description Saleor, an e-commerce platform, permitted authenticated staff users or Apps to upload arbitrary files, including potentially malicious HTML and SVG files containing Javascript. If media files are hosted on the same domain as the dashboard, these files could be served without restrictions, leading to the execution of malicious scripts within the user's browser. A malicious staff member could potentially inject scripts to target other staff members, potentially compromising their access and refresh tokens. The issue is present when media files are not served with a Content-Disposition: attachment header. Saleor Cloud users are not affected. The vulnerable API endpoint is not specified. The vulnerable parameter is not specified. The vulnerable function is not specified.

Recommendations Saleor versions 3.0.0 through 3.20.107: Upgrade to version 3.20.108 or later. Saleor versions 3.21.0 through 3.21.42: Upgrade to version 3.21.43 or later. Saleor versions 3.22.0 through 3.22.26: Upgrade to version 3.22.27 or later. Configure servers hosting media files to return the Content-Disposition: attachment header. Prevent servers from serving HTML and SVG files. Implement a Content-Security-Policy for media files, such as Content-Security-Policy: default-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'none';.

Exploit

Correção

XSS

Unrestricted File Upload

Enumeração de Fraquezas

CWE-79

CWE-434

Identificadores relacionados

CVE-2026-23499

GHSA-666H-2P49-PG95

Produtos afetados

Saleor

Referências · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23499.json · Exploit
• https://github.com/saleor/saleor/commit/b3cb27b3fe96dae3c879063e56d32a9398eabd24 · Correção
• https://github.com/saleor/saleor/commit/ac6936a336289c77398ef600cad3498ad4ba261c · Correção
• https://github.com/saleor/saleor/commit/7d33efc7a06252320cd51cbb20c2e308aed2fd10 · Correção
• https://github.com/saleor/saleor/security/advisories/GHSA-666h-2p49-pg95 · Aviso do Fabricante
• https://github.com/saleor/saleor/commit/9110eba68c3f73afa1f72b45bd9b1394c752d335 · Correção
• https://github.com/saleor/saleor/commit/77f7927a0db9a216440df92c51012136f13e1d99 · Correção
• https://t.me/CVEtracker/42698 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2014095562748862922 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-23499 · Aviso do Fabricante
• https://docs.saleor.io/security/#restricted-file-uploads · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-23499 · Nota de Segurança