CVE-2026-105798

Summary

The flaw allows an authenticated user to inject malicious script into group document filenames, which can be executed when another group member clicks a Share link, leading to potential data access and session hijacking.

Exploitability

Exploitation requires an authenticated user with Owner, Admin, or DocumentManager privileges in a specific group. The attacker must upload a malicious document filename.

Blast radius

If exploited, the flaw could grant the attacker access to victim-visible data and actions within the victim's session, potentially leading to data theft or manipulation.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 0.261.029 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.