PT-2026-29508 · Harvard University · Iqss Dataverse

Justf0Rfun + 1 · CVE-2026-1879 · Published 2026-04-01 · Updated 2026-04-01

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Harvard University IQSS Dataverse versions up to 6.8

Description A flaw exists in Harvard University IQSS Dataverse that allows for unrestricted file upload through manipulation of the uploadLogo argument in the /ThemeAndWidgets.xhtml file within the Theme Customization component. This issue is publicly exploitable.

Recommendations Upgrade to version 6.10 or later.

Exploit

Fix

Improper Access Control

Unrestricted File Upload

Weakness Enumeration

CWE-284

CWE-434

Related Identifiers

CVE-2026-1879

Affected Products

Iqss Dataverse

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/1xxx/CVE-2026-1879.json · Exploit
• 🔥 https://gist.github.com/KaiqueFerreiraPeres/ba039887d7f894a7c38252314e0ef2cc · Exploit
• https://github.com/IQSS/dataverse/releases/tag/v6.10 · Patch
• https://osv.dev/vulnerability/CVE-2026-1879 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-1879 · Security Note
• https://vuldb.com/vuln/354616 · Note
• https://twitter.com/CVEnew/status/2039372068572025021 · Twitter Post
• https://vuldb.com/vuln/354616/cti · Note
• https://vuldb.com/submit/749003 · Note