CVE-2026-1879

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-1879

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-1879.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-1879

Published

2026-04-01T10:00:10.991Z

Modified

2026-07-15T01:49:12.434065982Z

Severity

2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

Harvard University IQSS Dataverse Theme Customization ThemeAndWidgets.xhtml unrestricted upload

Details

A vulnerability was detected in Harvard University IQSS Dataverse up to 6.8. This affects an unknown function of the file /ThemeAndWidgets.xhtml of the component Theme Customization. Performing a manipulation of the argument uploadLogo results in unrestricted upload. Remote exploitation of the attack is possible. The exploit is now public and may be used. Upgrading to version 6.10 mitigates this issue. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Database specific

{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-284",
        "CWE-434"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/1xxx/CVE-2026-1879.json"
}

References

Affected packages

Git / github.com/iqss/dataverse

Affected ranges

Type

GIT

Repo

https://github.com/iqss/dataverse

Events

Introduced

5f2413b5d518d01173d871133e5f63f8c0604b51

Fixed

270032e01ef1e5386eb768e03edd11ce39d15279

Database specific

{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "6.0"
        },
        {
            "last_affected": "6.0"
        },
        {
            "introduced": "6.1"
        },
        {
            "last_affected": "6.1"
        },
        {
            "introduced": "6.2"
        },
        {
            "last_affected": "6.2"
        },
        {
            "introduced": "6.3"
        },
        {
            "last_affected": "6.3"
        },
        {
            "introduced": "6.4"
        },
        {
            "last_affected": "6.4"
        },
        {
            "introduced": "6.5"
        },
        {
            "last_affected": "6.5"
        },
        {
            "introduced": "6.6"
        },
        {
            "last_affected": "6.6"
        },
        {
            "introduced": "6.7"
        },
        {
            "last_affected": "6.7"
        },
        {
            "introduced": "6.8"
        },
        {
            "last_affected": "6.8"
        }
    ]
}

Affected versions

6.*

6.0

6.1

6.2

6.3

6.4

6.5

6.6

6.7

6.8

v6.*

v6.0

v6.2

v6.3

v6.4

v6.5

v6.6

v6.7

v6.7.1

v6.8

v6.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-1879.json"