CVE-2026-28274 - Vulnerability Analysis

Overview

Initiative < 0.32.4 contains a stored XSS caused by improper sanitization of uploaded .html/.htm files in document upload, letting users with upload permissions execute scripts in application context, exploit requires upload permissions.

Severity & Score

Impact

Attackers with upload permissions can execute scripts to steal authentication tokens and session cookies, compromising user accounts and data.

Mitigation

Upgrade to version 0.32.4 or later.

References

• https://github.com/Morelitea/initiative/releases/tag/v0.32.4
• https://github.com/Morelitea/initiative/security/advisories/GHSA-v38c-x27x-p584

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner