{"affected":[{"product":"hubleys-dashboard","source":"CNA: GitHub_M","vendor":"knrdl","versions":[{"status":"affected","version":"< 0.5.2"}]}],"cveId":"CVE-2026-67444","cwes":["CWE-79","CWE-434"],"description":"Hubleys is a dashboard for self-hosted services. Prior to version 0.5.2, any authenticated (non-admin) Hubleys user can upload a file with an arbitrary extension as their dashboard \"background image,\" and the server will later serve that file back with a Content-Type derived straight from the attacker's chosen extension - so uploading an .html file gets it served as text/html. Because the endpoint that serves it returns a manually-constructed response rather than going through SvelteKit's normal page-rendering pipeline, the app's configured Content-Security-Policy never gets attached to it either, so a script embedded in the upload runs unrestricted. This issue has been patched in version 0.5.2.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":7.1,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","version":"4.0"}],"modifiedAt":1794596524830,"publishedAt":1794596524830,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/knrdl/hubleys-dashboard/security/advisories/GHSA-j2w9-hhqw-mrq8"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/knrdl/hubleys-dashboard/commit/5a7f04c153295d48319d35fdd53e30f50288cd37"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/knrdl/hubleys-dashboard/releases/tag/v0.5.2"}],"remediation":[],"revision":"72d982b6bdc7d846f9ca1cff7d69b3cb97036ae31fc2e3e663c2536522600afc","sources":[{"modifiedAt":1794596524830,"name":"CNA: GitHub_M","retrievedAt":1794600614475,"url":"https://www.cve.org/CVERecord?id=CVE-2026-67444"}],"ssvc":null,"status":"published","title":"Hubleys: Stored XSS via unrestricted background-image upload, served with an attacker-chosen Content-Type and no CSP protection","updatedAt":1794600614475}