PT-2026-39723 · Sonatype · Nexus Repository

Ky0Tofu · Published 2026-05-11 · Updated 2026-05-11 · CVE-2026-7308

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Sonatype Nexus Repository versions 3.6.0 through 3.91.0

Description An authenticated user with upload permissions to a hosted repository can store content that triggers arbitrary JavaScript execution in the browser of any user viewing that repository directory through the HTML index page. This allows an attacker to perform actions within the context of the victim's session.

Recommendations Update to version 3.92.0 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-7308

Affected Products

Nexus Repository

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-7308 · Security Note
• https://help.sonatype.com/en/sonatype-nexus-repository-3-92-0-release-notes.html · Patch
• https://support.sonatype.com/hc/en-us/articles/51592065985939 · Vendor Advisory
• https://twitter.com/CVEnew/status/2053932407129297314 · Twitter Post
• https://t.me/CVEtracker/53400 · Telegram Post