PT-2026-3867 · Saleor · Saleor

Lukasz-Rybak · Published 2026-01-21 · Updated 2026-01-21 · CVE-2026-23499

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Saleor versions 3.0.0 through 3.20.107 Saleor versions 3.21.0 through 3.21.42 Saleor versions 3.22.0 through 3.22.26

Description Saleor, an e-commerce platform, permitted authenticated staff users or Apps to upload arbitrary files, including potentially malicious HTML and SVG files containing Javascript. If media files are hosted on the same domain as the dashboard, these files could be served without restrictions, leading to the execution of malicious scripts within the user's browser. A malicious staff member could potentially inject scripts to target other staff members, potentially compromising their access and refresh tokens. The issue is present when media files are not served with a Content-Disposition: attachment header. Saleor Cloud users are not affected. The vulnerable API endpoint is not specified. The vulnerable parameter is not specified. The vulnerable function is not specified.

Recommendations Saleor versions 3.0.0 through 3.20.107: Upgrade to version 3.20.108 or later. Saleor versions 3.21.0 through 3.21.42: Upgrade to version 3.21.43 or later. Saleor versions 3.22.0 through 3.22.26: Upgrade to version 3.22.27 or later. Configure servers hosting media files to return the Content-Disposition: attachment header. Prevent servers from serving HTML and SVG files. Implement a Content-Security-Policy for media files, such as Content-Security-Policy: default-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'none';.

Exploit

Fix

XSS

Unrestricted File Upload

Weakness Enumeration

CWE-79

CWE-434

Related Identifiers

CVE-2026-23499

GHSA-666H-2P49-PG95

Affected Products

Saleor

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23499.json · Exploit
• https://github.com/saleor/saleor/commit/b3cb27b3fe96dae3c879063e56d32a9398eabd24 · Patch
• https://github.com/saleor/saleor/commit/ac6936a336289c77398ef600cad3498ad4ba261c · Patch
• https://github.com/saleor/saleor/commit/7d33efc7a06252320cd51cbb20c2e308aed2fd10 · Patch
• https://github.com/saleor/saleor/security/advisories/GHSA-666h-2p49-pg95 · Vendor Advisory
• https://github.com/saleor/saleor/commit/9110eba68c3f73afa1f72b45bd9b1394c752d335 · Patch
• https://github.com/saleor/saleor/commit/77f7927a0db9a216440df92c51012136f13e1d99 · Patch
• https://osv.dev/vulnerability/CVE-2026-23499 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23499 · Security Note
• https://t.me/CVEtracker/42698 · Telegram Post
• https://twitter.com/CVEnew/status/2014095562748862922 · Twitter Post
• https://docs.saleor.io/security/#restricted-file-uploads · Note