CVE-2026-101158

Summary

A stored XSS vulnerability in the Fileserver upload API allows authenticated attackers with file upload privileges to inject malicious scripts that execute in other users' browsers. This could lead to session hijacking and full account compromise.

Exploitability

Exploitation requires an authenticated user with file upload permissions, making it moderately difficult but achievable through social engineering or compromised credentials.

Blast radius

The vulnerability could impact multiple CloudVision users whose sessions are hijacked, potentially allowing attackers to gain administrative access to the entire system.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Disable the Fileserver upload API endpoint until a patch is available, or restrict access to it via network segmentation.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.