PT-2026-28480 · Sakai · Sakai

Published 2026-03-26 · Updated 2026-03-27 · CVE-2026-33402

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Sakai versions 23.0 through 23.4 Sakai versions 25.0 through 25.1

Description Sakai is a Collaboration and Learning Environment (CLE). Group titles and descriptions can contain cross-site scripting scripts. The issue affects versions 23.0 through 23.4 and 25.0 through 25.1. As a workaround, the SAKAI SITE GROUP table can be checked for titles and descriptions containing malicious scripts.

Recommendations Update to Sakai version 23.5 or later. Update to Sakai version 25.2 or later. As a workaround, check the SAKAI SITE GROUP table for titles and descriptions that contain potentially malicious scripts.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-33402

Affected Products

Sakai

References · 5

• https://github.com/sakaiproject/sakai/security/advisories/GHSA-6g62-3898-hpvm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33402 · Security Note
• https://twitter.com/infoflowcloud/status/2037515436531515497 · Twitter Post
• https://twitter.com/CVEnew/status/2037513431130026042 · Twitter Post
• https://sakaiproject.atlassian.net/browse/SAK-52311 · Note