Medium severity · published Mar 3, 2026
CVE-2026-26272
HomeBox affected by Stored XSS via HTML/SVG Attachment Upload
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
HomeBox is a home inventory and organization system. Prior to 0.24.0-rc.1, a stored cross-site scripting (XSS) vulnerability exists in the item attachment upload functionality. The application does not properly validate or restrict uploaded file types, allowing an authenticated user to upload malicious HTML or SVG files containing executable JavaScript (also, potentially other formats that render scripts). Uploaded attachments are accessible via direct links. When a user accesses such a file in their browser, the embedded JavaScript executes in the context of the application's origin. This vulnerability is fixed in 0.24.0-rc.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 7% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HO
homebox · sysadminsmedia
< 0.24.0-rc.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-26272
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-26272
Patch
https://github.com/sysadminsmedia/homebox/commit/51bd04e5f4656b306a296745ddd854d45aa3b892
Vendor Advisory
https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-55fv-9q6q-vpcr
More from homebox
8.1
CVE-2026-48826
HomeBox: Cross-Group Inventory Wipe in Homebox via Global Owner Role and X-Tenant Header Switching
8.1
CVE-2026-48975
HomeBox: Cross-Tenant IDOR in MaintenanceEntry Update and Delete Allows Tampering and Destruction of Any User's Maintenance History in Homebox
8.1
CVE-2026-48976
HomeBox: Cross-Tenant IDOR in Notifier Update Leaks Shoutrrr Credentials and Allows Webhook Hijack
8.1
CVE-2026-40196
HomeBox has Unauthorized API Access via Retained defaultGroup ID After Group Access Revocation
7.4
CVE-2026-27981
HomeBox has an Auth Rate Limit Bypass via IP Spoofing