PT-2026-22222 · Unknown · Initiative

G3Xar · Published 2026-02-26 · Updated 2026-03-03 · CVE-2026-28274

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Initiative versions prior to 0.32.4

Description Initiative is a self-hosted project management platform vulnerable to Stored Cross-Site Scripting (XSS) in the document upload functionality. Users with upload permissions within the "Initiatives" section can upload malicious .html or .htm files. These files are served under the application’s origin without proper sandboxing, allowing embedded JavaScript to execute in the application’s context. This can lead to the exfiltration of authentication tokens, session cookies, or other sensitive data to an attacker-controlled server. Sharing the direct file link may also result in the execution of the malicious script when accessed.

Recommendations Upgrade to version 0.32.4 or later.

Exploit

Fix

Unrestricted File Upload

XSS

Weakness Enumeration

CWE-434

CWE-79

Related Identifiers

CVE-2026-28274

GHSA-V38C-X27X-P584

Affected Products

Initiative

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28274.json · Exploit
• https://github.com/Morelitea/initiative/security/advisories/GHSA-v38c-x27x-p584 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28274 · Security Note
• https://osv.dev/vulnerability/CVE-2026-28274 · Vendor Advisory
• https://github.com/Morelitea/initiative/releases/tag/v0.32.4 · Note
• https://twitter.com/TheHackerWire/status/2027161994730811710 · Twitter Post
• https://twitter.com/CVEnew/status/2027466632122274007 · Twitter Post
• https://twitter.com/CveTodo/status/2027166551820882028 · Twitter Post
• https://twitter.com/CveFindCom/status/2027167236935368969 · Twitter Post
• https://twitter.com/pulsepatchio/status/2027754402677686621 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2027175216837804433 · Twitter Post
• https://twitter.com/cracbot/status/2028787701990973599 · Twitter Post