What’s Vulnerable › Vulnerabilities

CVE-2026-45228: Quark Drive (quark-auto-save) < 0.8.5 Stored XSS via System Configuration

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-13 · updated 2026-10-26
• Weakness: CWE-79

Description

Quark Drive before 0.8.5 contains a stored cross-site scripting vulnerability in the System Configuration page where the template renders push_config key names using Vue.js's v-html directive without escaping. Authenticated attackers can inject HTML or JavaScript payloads as key names through the POST /update endpoint, which are persisted to disk and executed in the browsers of all authenticated users accessing the System Configuration tab, allowing session cookie exfiltration and arbitrary authenticated actions.

Affected products

• Cp0204 quark-auto-save: before 0.8.5 — fixed in 0.8.5

How to fix

Upgrade to a fixed version: Cp0204 quark-auto-save 0.8.5. Check the vendor advisory for mitigations.

References

• https://github.com/Cp0204/quark-auto-save/commit/8436e2821988637ed7bfc5562544d089e6b29478
• https://github.com/Cp0204/quark-auto-save/releases/tag/v0.8.5
• https://www.vulncheck.com/advisories/quark-drive-stored-xss-via-system-configuration

Get alerted when CVE-2026-45228 or the next vulnerability affects your stack