PT-2026-20993 · Flare · Flare

G3Xar · Published 2026-02-20 · Updated 2026-03-03 · CVE-2026-26993

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Flare versions 1.7.0 and below

Description Flare, a Next.js-based file sharing platform, is susceptible to a stored Cross-Site Scripting (XSS) issue. The platform does not properly validate or sanitize uploaded files. An attacker can embed malicious JavaScript within an SVG, HTML, or XML file. When a user views the file in “raw” mode, the embedded script executes in the application's context, potentially allowing for the exfiltration of user data. The vulnerability occurs due to insufficient content validation during file uploads.

Recommendations Update to Flare version 1.7.1 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-26993

GHSA-Q8FP-W6M5-4GJM

Affected Products

Flare

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26993.json · Exploit
• https://github.com/FlintSH/Flare/security/advisories/GHSA-q8fp-w6m5-4gjm · Vendor Advisory
• https://github.com/FlintSH/Flare/commit/7763d7b954799552f287ab9260bb1353f8880163 · Patch
• https://osv.dev/vulnerability/CVE-2026-26993 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26993 · Security Note
• https://github.com/FlintSH/Flare/releases/tag/v1.7.1 · Note
• https://t.me/cveNotify/153995 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2024829860716093847 · Twitter Post
• https://t.me/CVEtracker/45237 · Telegram Post