{"id":"CVE-2026-124491","published":"2026-11-08T14:18:18.817","lastModified":"2026-11-09T15:17:17.620","description":"SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the FileUpload plugin create() method that assigns server-returned file names to innerHTML without escaping. Attackers can upload files with HTML-laden names that bypass html.clean() and execute JavaScript in victims' browsers when content or gallery items load, enabling session theft.","cvssScore":6.4,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","cwes":["CWE-79"],"vendors":[],"products":[],"references":[{"url":"https://github.com/JiHong88/suneditor/security/advisories/GHSA-2w4v-r3v4-f5h4","tags":[]},{"url":"https://www.vulncheck.com/advisories/suneditor-before-3.4.0-stored-xss-via-fileupload-plugin-filename","tags":[]},{"url":"https://github.com/JiHong88/suneditor/security/advisories/GHSA-2w4v-r3v4-f5h4","tags":[]}],"exploitRefs":[{"url":"https://github.com/JiHong88/suneditor/security/advisories/GHSA-2w4v-r3v4-f5h4","tags":[]},{"url":"https://github.com/JiHong88/suneditor/security/advisories/GHSA-2w4v-r3v4-f5h4","tags":[]}],"hasPoc":true,"ai":null}