What’s Vulnerable › Vulnerabilities

CVE-2026-7308: Nexus Repository 3 - Stored Cross-Site Scripting (XSS) via HTML Browse Page

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-11 · updated 2026-10-26
• Weakness: CWE-79

Description

An authenticated user with upload permission to a hosted repository can store content that causes arbitrary JavaScript to execute in the browser of any user who browses that repository directory via the HTML index page in Sonatype Nexus Repository versions 3.6.0 through versions before 3.92.0. This could allow the attacker to perform actions in the context of the victim's session.

Affected products

• Sonatype Nexus Repository 3: from 3.6.0 before 3.93.0 — fixed in 3.93.0

How to fix

Upgrade to a fixed version: Sonatype Nexus Repository 3 3.93.0. Check the vendor advisory for mitigations.

References

• https://help.sonatype.com/en/sonatype-nexus-repository-3-92-0-release-notes.html
• https://support.sonatype.com/hc/en-us/articles/51592065985939

Get alerted when CVE-2026-7308 or the next vulnerability affects your stack