PT-2026-20328 · Unknown+1 · Flask-Multipass+1
Dreyercito
·
Published
2026-02-17
·
Updated
2026-02-26
·
CVE-2026-25739
CVSS v3.1
5.4
Medium
| Vector | AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Indico versions prior to 3.3.10
Description
Indico, an event management system, is susceptible to a cross-site scripting issue when specific file types are uploaded as materials. The issue exists due to a flaw in the handling of file uploads. The system uses Flask-Multipass, a multi-backend authentication system for Flask. There is no information about the number of potentially affected devices worldwide or any real-world incidents where this issue was exploited. The vulnerable component is related to material upload functionality.
Recommendations
Upgrade to version 3.3.10 to resolve the issue.
If using nginx with Indico's
STATIC FILE METHOD set to xaccelredirect, update the webserver configuration to include the following line in the .xsf/indico/ location block: add header Content-Security-Policy $upstream http content security policy;.
As a workaround, apply a strict Content Security Policy for material download endpoints using your webserver configuration.
As a workaround, restrict content creation, including material uploads, to trustworthy users only.Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Flask-Multipass
Indico