CVE-2026-28274

{
  "id": "CVE-2026-28274",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-28274",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-02-27T17:47:00.683761Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.7,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.8,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "Morelitea",
          "product": "initiative",
          "versions": [
            {
              "status": "affected",
              "version": "< 0.32.4"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-02-26T23:16:37.073",
  "references": [
    {
      "url": "https://github.com/Morelitea/initiative/releases/tag/v0.32.4",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Morelitea/initiative/security/advisories/GHSA-v38c-x27x-p584",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        },
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Initiative is a self-hosted project management platform. Versions of the application prior to 0.32.4 are vulnerable to Stored Cross-Site Scripting (XSS) in the document upload functionality. Any user with upload permissions within the \"Initiatives\" section can upload a malicious `.html` or `.htm` file as a document. Because the uploaded HTML file is served under the application's origin without proper sandboxing, the embedded JavaScript executes in the context of the application. As a result, authentication tokens, session cookies, or other sensitive data can be exfiltrated to an attacker-controlled server. Additionally, since the uploaded file is hosted under the application's domain, simply sharing the direct file link may result in execution of the malicious script when accessed. Version 0.32.4 fixes the issue."
    },
    {
      "lang": "es",
      "value": "Initiative es una plataforma de gestión de proyectos autohospedada. Las versiones de la aplicación anteriores a la 0.32.4 son vulnerables a Cross-Site Scripting Almacenado (XSS) en la funcionalidad de carga de documentos. Cualquier usuario con permisos de carga dentro de la sección 'Initiatives' puede cargar un archivo .html o .htm malicioso como documento. Debido a que el archivo HTML cargado se sirve bajo el origen de la aplicación sin un sandboxing adecuado, el JavaScript incrustado se ejecuta en el contexto de la aplicación. Como resultado, los tokens de autenticación, las cookies de sesión u otros datos sensibles pueden ser exfiltrados a un servidor controlado por el atacante. Además, dado que el archivo cargado está alojado bajo el dominio de la aplicación, simplemente compartir el enlace directo al archivo puede resultar en la ejecución del script malicioso al ser accedido. La versión 0.32.4 corrige el problema."
    }
  ],
  "lastModified": "2026-06-17T10:28:24.827",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:morelitea:initiative:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "14E07E5B-5651-4A27-86E2-CE508B70B3B6",
              "versionEndExcluding": "0.32.2"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}