CVE-2026-1466

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-1466

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-1466.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-1466

Published

2026-01-28T06:33:15.181Z

Modified

2026-02-13T23:42:10.345119Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Jirafeau

Details

Jirafeau normally prevents browser preview for text files due to the possibility that for example SVG and HTML documents could be exploited for cross site scripting. This was done by storing the MIME type of a file and allowing only browser preview for MIME types beginning with image (except for image/svg+xml, see CVE-2022-30110, CVE-2024-12326 and CVE-2025-7066), video and audio. However, it was possible to bypass this check by sending a manipulated HTTP request with an invalid MIME type like image. When doing the preview, the browser tries to automatically detect the MIME type resulting in detecting SVG and possibly executing JavaScript code. To prevent this, MIME sniffing is disabled by sending the HTTP header X-Content-Type-Options: nosniff.

Database specific

{
    "cna_assigner": "GitLab",
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/1xxx/CVE-2026-1466.json"
}

References

Affected packages

Git / gitlab.com/jirafeau/jirafeau

Affected ranges

Type: GIT
Repo: https://gitlab.com/jirafeau/jirafeau
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

f1b3cb91458721a5c2a5a8779b35113688f8f0bd

Affected versions

1.*

1.0

1.1

1.2.0

2.*

2.0.0

3.*

3.0.0

3.1.0

3.2.0

3.2.1

3.3.0

3.4.0

3.4.1

4.*

4.0.0

4.1.0

4.1.1

4.2.0

4.3.0

4.4.0

4.5.0

4.6.0

4.6.1

4.6.2

4.6.3

4.7.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-1466.json"