quark-auto-save vulnerabilities
CVEs whose affected-version data names the quark-auto-save package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-45228Medium· 5.4Quark Drive (quark-auto-save) < 0.8.5 Stored XSS via System Configuration
Quark Drive before 0.8.5 contains a stored cross-site scripting vulnerability in the System Configuration page where the template renders push_config key names using Vue.js's v-html directive without escaping. Authenticated attackers can…
▾ SunlitCp0204 · quark-auto-saveEPSS 0.18%via CVEORG
CVE-2026-45229High· 8.8Quark Drive (quark-auto-save) < 0.8.5 Mass Assignment via POST /update
Quark Drive before 0.8.5 contains a mass assignment vulnerability in the POST /update endpoint that allows authenticated attackers to overwrite administrator credentials by posting an arbitrary webui object to the config_data dictionary.…
▾ TwilightCp0204 · quark-auto-saveEPSS 0.37%via CVEORG