Description

Unauthenticated Cross Site Scripting (XSS) in Global Gallery <= 11.1.2 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-19T13:18:06.863Z",
  "pubdate": "2026-08-19T13:18:06.863Z",
  "executiveSummary": "An unauthenticated Cross-Site Scripting (XSS) vulnerability has been identified in the Global Gallery plugin, specifically affecting versions 11.1.2 and prior. This security flaw allows remote, unauthenticated attackers to inject malicious client-side scripts, typically JavaScript, into web pages rendered by the application and viewed by other users. The primary impact of this vulnerability includes session hijacking, credential theft, and the manipulation or defacement of the affected web application's interface. Because the vulnerability requires no prior authentication or elevated privileges, any external threat actor interacting with the network-exposed target can initiate exploitation under favorable conditions. The presence of this vulnerability introduces significant risk implications, potentially compromising the integrity and confidentiality of user sessions interacting with Global Gallery components. Remediation requires applying vendor-supplied updates or patches that properly sanitize and encode user-supplied input before rendering it in the Document Object Model (DOM).",
  "technicalDetails": "The vulnerability stems from insufficient input sanitization and output encoding within the Global Gallery plugin for versions <= 11.1.2. The root cause lies in the application's failure to adequately validate parameters supplied via HTTP requests before reflecting them back into the Document Object Model (DOM) or storing them for later retrieval and rendering. This flaw exposes an unauthenticated attack vector accessible via network exposure, requiring no prior authentication or privilege requirements to interact with the vulnerable component.\nThe attack flow proceeds as follows: First, the unauthenticated attacker crafts a malicious payload containing executable JavaScript encapsulated within HTML tags or event handlers. Second, the attacker induces a victim to interact with a maliciously crafted URL or input vector targeting the vulnerable Global Gallery component. Third, the application processes the input without proper sanitization and embeds the malicious payload directly into the HTTP response returned to the client browser. Finally, the victim's browser interprets the injected payload as legitimate application script and executes it within the context of the user's session.\nThe payload behavior leverages the trust relationship between the victim's browser and the web application. Upon execution, the injected script operates with the privileges of the victim, enabling unauthorized actions such as accessing session cookies, local storage, or performing actions on behalf of the user. The post-exploitation impact includes potential privilege escalation, account takeover via session token theft, and persistent defacement depending on the exact execution context of the reflected or stored vector."
}