Quay: Unvalidated Filedrop MIME Allows Stored XSS via SVG
CVE-2026-11569 Published on June 8, 2026
Quay: quay: stored xss via filedrop svg upload
A flaw was found in Quay. The filedrop endpoint accepts any mime type without validation, allowing an authenticated user with repository write access to upload a malicious SVG file containing JavaScript. The file is stored and served inline through the CDN, enabling stored cross-site scripting when a victim visits the archive URL.
Vulnerability Analysis
CVE-2026-11569 can be exploited with network access, requires user interaction and a small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.
Timeline
Reported to Red Hat.
Made public.
Weakness Type
What is a XSS Vulnerability?
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVE-2026-11569 has been classified to as a XSS vulnerability or weakness.
Products Associated with CVE-2026-11569
Want to know whenever a new CVE is published for Red Hat Quay? stack.watch will email you.
