PT-2026-42666 · Commenthol+1 · M-Files Server

Published 2026-05-21 · Updated 2026-06-09 · CVE-2026-46492

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions md-fileserver versions prior to 1.10.3

Description A cross-site scripting (XSS) issue exists in the Markdown rendering logic. When user-supplied Markdown content is rendered, embedded raw HTML, such as <script> tags or event handlers (e.g., <img onerror=...>), is processed and injected into the resulting page without sanitization. This allows arbitrary JavaScript execution in the context of the affected domain. The issue is caused by the markdownIt configuration in config.js being set to allow raw HTML, the lack of sanitization in the lib/markd.js rendering process, and the unsanitized injection of the markdown variable into the lib/pages/template.html template.

Recommendations Update to version 1.10.3.

Exploit

Fix

XSS

Weakness Enumeration

CWE-80

CWE-87

Related Identifiers

CVE-2026-46492

GHSA-32Q2-HHR5-6QVV

Affected Products

M-Files Server

References · 6

• 🔥 https://github.com/commenthol/md-fileserver/security/advisories/GHSA-32q2-hhr5-6qvv · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-46492 · Security Note
• https://osv.dev/vulnerability/GHSA-32q2-hhr5-6qvv · Vendor Advisory
• https://github.com/commenthol/md-fileserver/releases/tag/v1.10.3 · Note
• https://github.com/commenthol/md-fileserver · Note
• https://t.me/CVEtracker/56328 · Telegram Post