CVE-2026-129172

CVSS 5.4 (medium) · published 2026-11-13

EdgeEver 1.9.0 before 2.13.0 contains a stored cross-site scripting vulnerability in the backup restore endpoint PUT /api/v1/restores/json/resources/:id, which accepts a resource kind of image paired with a text/html MIME type without checking consistency. Authenticated members can share the note and send the public blob link to a victim, whose browser executes the script to mint a non-expiring API token granting read and write access to the victim's notes.

Weakness: CWE-79

Source: NVD CVE-2026-129172

References

• https://github.com/tianma-if/edgeever/blob/eeaab088f41d0417fbce2266f58ff4adde7f5d76/apps/api/src/backup-routes.ts#L487-L550
• https://github.com/tianma-if/edgeever/blob/eeaab088f41d0417fbce2266f58ff4adde7f5d76/apps/api/src/share-routes.ts#L77-L80
• https://github.com/tianma-if/edgeever/commit/dc5a55a1c26d6add0e28d95dc0b282c611692e34
• https://github.com/tianma-if/edgeever/issues/701
• https://vul.yulun.ac.cn/20261028/edgeever/
• https://www.vulncheck.com/advisories/edgeever-1.9.0-before-2.13.0-stored-xss-via-backup-restore-and-public-shares

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.