CVE-2026-26993

MEDIUM EPSS 19.7%
Published Feb 20, 20264mo ago · Modified Jun 17, 20261w ago
5.4 CVSS 3.1
Medium
Find Similar
Published Feb 20, 2026 4mo ago
Last Modified Jun 17, 2026 1w ago

Description

Flare is a Next.js-based, self-hostable file sharing platform that integrates with screenshot tools. Versions 1.7.0 and below allow users to upload files without proper content validation or sanitization. By embedding malicious JavaScript within an SVG (or other active content formats such as HTML or XML), an attacker can achieve script execution in the context of the application's origin when a victim views the file in “raw” mode. This results in a stored Cross-Site Scripting (XSS) vulnerability that can be exploited to exfiltrate user data. This issue has been fixed in version 1.7.1.

CVSS Details

Base Score
5.4
Exploitability
2.3
Impact
2.7
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction Required
Scope Changed
Confidentiality Low
Integrity Low
Availability None

Threat Intelligence

EPSS Exploit Probability
19.7% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

Affected Products 1

VendorProductVersionRange
flintshflare* <1.7.1

References 3

  • github.com https://github.com/FlintSH/Flare/commit/7763d7b954799552f287ab9260bb1353f8880163
    Patch
  • github.com https://github.com/FlintSH/Flare/releases/tag/v1.7.1
    ProductRelease Notes
  • github.com https://github.com/FlintSH/Flare/security/advisories/GHSA-q8fp-w6m5-4gjm
    ExploitVendor Advisory

Remediation

  • github.com https://github.com/FlintSH/Flare/commit/7763d7b954799552f287ab9260bb1353f8880163
    Patch