PT-2026-22773 · Homebox · Homebox

G3Xar · Published 2026-03-03 · Updated 2026-03-04 · CVE-2026-26272

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions HomeBox versions prior to 0.24.0-rc.1

Description HomeBox is a home inventory and organization system. A stored cross-site scripting (XSS) issue exists in the item attachment upload functionality. The application does not properly validate or restrict uploaded file types, allowing an authenticated user to upload malicious HTML or SVG files containing executable JavaScript. Uploaded attachments are accessible via direct links. When a user accesses such a file in their browser, the embedded JavaScript executes in the context of the application's origin. The vulnerable functionality involves the upload of attachments.

Recommendations Update to version 0.24.0-rc.1 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-26272

GHSA-55FV-9Q6Q-VPCR

Affected Products

Homebox

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26272.json · Exploit
• https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-55fv-9q6q-vpcr · Vendor Advisory
• https://github.com/sysadminsmedia/homebox/commit/51bd04e5f4656b306a296745ddd854d45aa3b892 · Patch
• https://osv.dev/vulnerability/CVE-2026-26272 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26272 · Security Note
• https://t.me/CVEtracker/46253 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2029077816331977206 · Twitter Post
• https://twitter.com/CVEnew/status/2028974437492461982 · Twitter Post
• https://reddit.com/r/selfhosted/comments/1rjtl6r/homebox_v0420_released · Reddit Post
• https://twitter.com/infoflowcloud/status/2028975348369539093 · Twitter Post