PandaWiki 3.65.0 through 3.87.5 Stored XSS via /static-file/ PDF Query-String Bypass
Affects PandaWiki 3.65.0 through 3.87.5 on knowledge bases that have no access password enabled. No vendor rating or fixed release is given in the checked facts.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- Proof of concept public, per CISA
- Fix
- No fix listed
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. The knowledge base does not have an access password enabled, so anonymous calls to the upload endpoint are allowed. Affected PandaWiki versions are 3.65.0 through 3.87.5. The nginx /static-file/ rule that skips Content-Disposition for requests with .pdf in the query string is present, which begins with v3.65.0.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- Published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 37/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: poc
- Automatable: no
- Technical impact: partial
Summary
PandaWiki, a wiki and knowledge-base platform, is affected by a stored cross-site scripting flaw that lets anyone without logging in upload HTML disguised as image files. When an administrator opens a crafted link, the malicious script can run in their browser and steal their login token, allowing an attacker to take over their session.
Read the original description
PandaWiki 3.65.0 through 3.87.5 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to upload HTML files with image extensions via /share/v1/common/file/upload. Attackers can lure administrators to /static-file/<key>?a=.pdf, bypassing the nginx attachment header to serve HTML inline and steal the panda_wiki_token JWT for session takeover.
What to do
Check whether your setup matches what the bug needs.
The knowledge base does not have an access password enabled, so anonymous calls to the upload endpoint are allowed. Affected PandaWiki versions are 3.65.0 through 3.87.5. The nginx /static-file/ rule that skips Content-Disposition for requests with .pdf in the query string is present, which begins with v3.65.0.Workaround: The checked facts list no workaround. The stated condition is that anonymous uploads are allowed on knowledge bases without an access password, so enabling one addresses that condition, though the facts do not confirm it closes the issue.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: poc · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- Chaitin PandaWiki
From 3.65.0 · through 3.87.5
Evidence 6
- Exploit
- Report
- Repository
- Repository
- Repository
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-120428
What does this mean?
An uploaded HTML file can run scripts when viewed, because a .pdf query string makes the nginx /static-file/ rule skip the Content-Disposition header. The impact described is that the script can read the administrator's panda_wiki_token JWT from localStorage and take over the admin session.Source: vul.yulun.ac.cn
Am I affected, and how do I check?
Versions 3.65.0 through 3.87.5 are in the affected range. The setup condition is a knowledge base without an access password, which allows anonymous calls to the upload endpoint. Check your PandaWiki version and whether the knowledge base has an access password enabled.Source: vul.yulun.ac.cn
What should I do about it?
The checked facts do not name a fixed version, so no upgrade target can be given from them. Check the vendor's advisory for a patched release.Source: vul.yulun.ac.cn
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. CISA's SSVC assessment notes a proof of concept exists. No public exploit code is tracked.Source: cve.now feed data
What if there's no patch?
The checked facts list no workaround. The stated condition is that anonymous uploads are allowed on knowledge bases without an access password, so enabling one addresses that condition, though the facts do not confirm it closes the issue.Source: vul.yulun.ac.cn