Is CVE-2026-120428 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-120428?

CVE-2026-120428 has a CVSS v3 severity of MEDIUM (6.1).

Back

CVE-2026-120428

Description

PandaWiki 3.65.0 through 3.87.5 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to upload HTML files with image extensions via /share/v1/common/file/upload. Attackers can lure administrators to /static-file/<key>?a=.pdf, bypassing the nginx attachment header to serve HTML inline and steal the panda_wiki_token JWT for session takeover.