CVE-2026-96535
5.1MediumPublished 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Passive
- Impact
- Limited impact
- Weakness
- CWE-79
Impact
Authenticated attackers can run malicious scripts in the context of the CDN domain if a victim visits an avatar URL directly. They need an account on the YouMind portal and user interaction to click or navigate to the image link.
Root cause
The avatar update endpoint fails to validate and sanitize SVG files fetched via user-provided URLs, serving malicious embedded JavaScript with an image/svg+xml MIME type.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Upgrade the YouMind portal once a patch is released. In the interim, configure the CDN to serve SVG uploads with a Content-Disposition: attachment header or sanitize incoming SVG files to strip script tags and event handlers.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Cross-Site Scripting on the YouMind portal, specifically in the avatar update endpoint, when setting a profile picture via an arbitrary URL. This occurs due to a lack of sanitisation and validation of SVG content when setting an SVG image containing embedded JavaScript code as the avatar. The file is served by the CDN with Content-Type: image/svg+xml and, when navigating directly to that URL, the script executes within the context of the CDN’s domain.