CriticalCritical vulnerability

CVE-2026-101158 (CVSS 9.3)

NVD · officialPublished Oct 6, 2026Risk 50/100

A missing input validation vulnerability in the Fileserver upload API allows an authenticated attacker with file upload privileges to execute stored cross-site scripting (XSS). Successful exploitation could enable the attacker to hijack another CloudVision user's web session, potentially granting full access to their account and administrative permissions.

Technical details

CVSS

9.3

AV:NetworkAC:LowPR:LowUI:Active

Evidence and sources

This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.

Open primary source