CVE-2026-28274 - Vulnerability Analysis

Overview

Initiative < 0.32.4 contains a stored XSS caused by improper sanitization of uploaded .html/.htm files in document upload, letting users with upload permissions execute scripts in application context, exploit requires upload permissions.

Severity & Score

Impact

Attackers with upload permissions can execute scripts to steal authentication tokens and session cookies, compromising user accounts and data.

Mitigation

Upgrade to version 0.32.4 or later.

References

• https://github.com/Morelitea/initiative/releases/tag/v0.32.4
• https://github.com/Morelitea/initiative/security/advisories/GHSA-v38c-x27x-p584

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Feb 27, 2026

🟠 CVE-2026-28274 - High (8.7) Initiative is a self-hosted project management platform. Versions of the application prior to 0.32.4 are vulnerable to Stored Cross-Site Scripting (XSS) in the document upload functionality. Any user with upload permissions within the "Initiatives... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28274/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner