PT-2026-20993 · Flare · Flare

G3Xar · Published 2026-02-20 · Updated 2026-02-20 · CVE-2026-26993

Positive Technologies · (AI Summary)

CVSS v3.1

4.6

4.6

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Flare versions 1.7.0 and below

Description Flare, a Next.js-based file sharing platform, is susceptible to a stored Cross-Site Scripting (XSS) issue. The platform does not properly validate or sanitize uploaded files. An attacker can embed malicious JavaScript within an SVG, HTML, or XML file. When a user views the file in “raw” mode, the embedded script executes in the application's context, potentially allowing for the exfiltration of user data. The vulnerability occurs due to insufficient content validation during file uploads.

Recommendations Update to Flare version 1.7.1 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-26993

Affected Products

Flare

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-26993 · Security Note
• https://github.com/FlintSH/Flare/commit/7763d7b954799552f287ab9260bb1353f8880163 · Note
• https://github.com/FlintSH/Flare/security/advisories/GHSA-q8fp-w6m5-4gjm · Note
• https://github.com/FlintSH/Flare/releases/tag/v1.7.1 · Note
• https://twitter.com/VulmonFeeds/status/2024829860716093847 · Twitter Post