What’s Vulnerable › Vulnerabilities

CVE-2026-63148: Omnispace Agora Project < 26.10.0 Stored XSS via Poll-Response Attachment Filename

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-13 · updated 2026-10-27
• Weakness: CWE-79

Description

Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject HTML/script markup by uploading a poll-response attachment with a malicious filename that bypasses the paramFilter sanitization applied to $_FILES. Attackers can submit a crafted filename that is stored and later rendered in components such as the dashboard controller (CtrlDashboard), executing arbitrary script in the browsers of users who view the affected page.

Affected products

• Omnispace Agora Project: before 26.10.0 — fixed in 26.10.0

How to fix

Upgrade to a fixed version: Omnispace Agora Project 26.10.0. Check the vendor advisory for mitigations.

References

• https://github.com/xech/agora-project/releases/tag/26.10
• https://www.agora-project.net/
• https://www.vulncheck.com/advisories/omnispace-agora-project-stored-xss-via-poll-response-attachment-filename

Get alerted when CVE-2026-63148 or the next vulnerability affects your stack