PT-2026-39723 · Sonatype · Nexus Repository

Ky0Tofu · Published 2026-05-11 · Updated 2026-05-11 · CVE-2026-7308

Mitre

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

An authenticated user with upload permission to a hosted repository can store content that causes arbitrary JavaScript to execute in the browser of any user who browses that repository directory via the HTML index page in Sonatype Nexus Repository versions 3.6.0 through versions before 3.92.0. This could allow the attacker to perform actions in the context of the victim's session.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-7308

Affected Products

Nexus Repository

References · 3

• https://help.sonatype.com/en/sonatype-nexus-repository-3-92-0-release-notes.html · Patch
• https://support.sonatype.com/hc/en-us/articles/51592065985939 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-7308 · Security Note