Is CVE-2026-111168 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-111168?

CVE-2026-111168 has a CVSS v3 severity of MEDIUM (5.4).

Back

CVE-2026-111168

Description

LibreDesk before 2.9.0-rc.8 contains a stored cross-site scripting vulnerability that allows authenticated agents to execute script by uploading SVGs with malformed Content-Type parameters. Attackers can upload an SVG typed 'image/svg+xml; x' via /api/v1/media so GET /uploads/{uuid} serves it inline without sandbox, running script in any viewing agent's or administrator's session.