Description

In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization icon uploads

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-09-07T17:17:27.397Z",
  "pubdate": "2026-09-07T17:17:27.397Z",
  "executiveSummary": "A stored Cross-Site Scripting (XSS) vulnerability exists within JetBrains YouTrack versions prior to 2026.2.18634, specifically involving the project and organization icon upload functionality.\nThis vulnerability allows an authenticated attacker to inject and execute arbitrary malicious scripts within the context of the victim's browser session.\nThe flaw stems from insufficient validation or sanitization of uploaded image files used for branding elements. By embedding malicious payloads within an icon file, an attacker can ensure the script executes whenever the icon is rendered in the user interface.\nThe impact includes potential session hijacking, unauthorized actions performed on behalf of the user, theft of sensitive authentication cookies, or redirection to malicious external domains.\nSuccessful exploitation requires the attacker to have sufficient privileges to upload or configure icons for projects or organizations. This represents a significant risk to organizational integrity, as it facilitates unauthorized script execution within the trust domain of the YouTrack application.",
  "technicalDetails": "The vulnerability resides in the application's file handling logic responsible for processing and storing custom iconography for project and organization entities. The root cause is a failure in the input validation mechanism during the file upload process, which does not adequately inspect the metadata or the binary content of the uploaded files for malicious script injection.\nThe exploitation flow begins when an attacker with the necessary permissions navigates to the project or organization settings interface. The attacker uploads a crafted file—typically disguised as an image—that contains embedded JavaScript payloads. Because the application processes these files and stores them on the server without rigorous sanitization or type verification, the malicious payload persists in the database.\nWhen a user, such as an administrator or another project member, visits the page where the icon is rendered, the browser retrieves the stored file. If the application serves the file without appropriate Content-Security-Policy (CSP) headers or incorrect MIME-type handling, the browser may interpret the embedded script as executable code within the context of the victim's session.\nThe payload executes in the Document Object Model (DOM) of the victim's browser, granting the attacker access to sensitive data accessible via JavaScript. This includes document.cookie, session storage, and the ability to make authenticated API requests to the YouTrack backend using the victim's existing credentials.\nAffected versions include all iterations of JetBrains YouTrack prior to 2026.2.18634. The vulnerability is exploitable via the standard web interface and requires authentication, though the level of privilege required is consistent with the ability to modify project or organizational settings. Post-exploitation impact is severe, as it bypasses standard authorization controls by operating through the authenticated user's browser, potentially leading to full account takeover or lateral movement within the project environment if the victim possesses higher-level administrative privileges."
}