{"id":"CVE-2026-11569","title":"Quay: quay: stored xss via filedrop svg upload","summary":"A flaw was found in Quay. The filedrop endpoint accepts any mime type without validation, allowing an authenticated user with repository write access to upload a malicious SVG file containing JavaScript. The file is stored and served inl…","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","cvssSource":"cna","cwe":["CWE-79"],"vendor":"Red Hat","product":"quay/quay-rhel8","affected":["quay/quay-rhel8 (all versions)","quay/quay-rhel9 (all versions)"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-06-08T12:15:25.821009Z"},"published":"2026-06-08","updated":"2026-11-01","sourceUpdated":"2026-11-01T05:06:44.799Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-11569","references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-11569"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2486194","label":"RHBZ#2486194"}],"tags":["cve.org"],"epss":0.00138,"epssPercentile":0.0322,"ingestedAt":"2026-11-05T18:28:50.692Z","slug":"CVE-2026-11569","body":"## Overview\n\nA flaw was found in Quay. The filedrop endpoint accepts any mime type without validation, allowing an authenticated user with repository write access to upload a malicious SVG file containing JavaScript. The file is stored and served inline through the CDN, enabling stored cross-site scripting when a victim visits the archive URL.\n\n## Affected\n\n- `quay/quay-rhel8 (all versions)`\n- `quay/quay-rhel9 (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":29.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}