CVE-2026-60043

Summary

CVE-2026-60043 is a cross-site scripting (XSS) vulnerability in a web application that allows unauthenticated attackers to execute malicious scripts in the context of a logged-in backend user. This enables privilege escalation to perform critical system actions such as shutting down the server or restoring backups.

Exploitability

Exploitation requires social engineering to trick a logged-in backend user into visiting a malicious link or page, as the attack needs user interaction (UI:R) and cannot be performed purely remotely without victim engagement.

Blast radius

Successful exploitation could lead to complete loss of system availability (e.g., server shutdown) and integrity (e.g., unauthorized backup restoration), potentially causing extended downtime or compromise via malicious backup content.

Detection

Defenders should monitor backend web server access logs for anomalous GET/POST requests containing script-like payloads (e.g., <script>, javascript:, onerror=) in query parameters or form fields, especially when originating from unauthenticated sessions targeting admin or backend endpoints. Additionally, inspect browser console errors or CSP violation reports if Content Security Policy is enforced.

Prioritized remediation

Upgrade to version 2.590 or later, as this is the fixed version specified in the advisory for CVE-2026-60043.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.