Medium severity · published May 11, 2026
CVE-2026-7308
Nexus Repository 3 - Stored Cross-Site Scripting (XSS) via HTML Browse Page
5.4
CVSS
0.3%
EPSS
No
On KEV
Description
An authenticated user with upload permission to a hosted repository can store content that causes arbitrary JavaScript to execute in the browser of any user who browses that repository directory via the HTML index page in Sonatype Nexus Repository versions 3.6.0 through versions before 3.92.0. This could allow the attacker to perform actions in the context of the victim's session.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 17% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NR
Nexus Repository · Sonatype
3.6.0 before 3.92.0 · source: vendor
NR
Nexus Repository Manager · Sonatype
3.6.0 before 3.93.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-7308
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-7308
Release Notes
https://help.sonatype.com/en/sonatype-nexus-repository-3-92-0-release-notes.html
Vendor Advisory
https://support.sonatype.com/hc/en-us/articles/51592065985939
More from Nexus Repository
9.8
CVE-2019-7238
Sonatype Nexus Repository Manager Incorrect Access Control Vulnerability
9.8
CVE-2026-5189
Nexus Repository 3 - Hardcoded Credential in Internal Database Component
9.8
CVE-2019-9629
Sonatype Nexus Repository Manager before 3.17.0 establishes a default administrator user with weak defaults (fixed credentials)
9.8
CVE-2017-17717
Sonatype Nexus Repository Manager through 2.14.5 has weak password encryption with a hardcoded CMMDwoV value in the LDAP integration feature
8.8
CVE-2026-17600
Nexus Repository 3 - Session Not Invalidated on User Account Deletion or Deactivation