https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 13:22:09 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-75529 <p>Pandora is affected by a stored cross-site scripting vulnerability in the PDF download functionality. The /task-download/&lt;task_id&gt;/.../pdf endpoint verifies that the submitted file is a PDF using Pandora&#39;s content-based file-type detection, but previously returned the file using send_file(task.file.path) without explicitly specifying the MIME type or forcing it to be downloaded as an attachment.</p> <p>Because Flask determines the response MIME type from the filename when a path is supplied, an attacker could submit a file whose content is recognized by Pandora as a PDF while its filename or extension causes the download endpoint to return it with a different, potentially active MIME type.</p> <p>A specially crafted PDF/polyglot file could therefore be served inline and interpreted by a victim&#39;s browser as HTML or another executable web format. If a victim with access to the submitted analysis follows the PDF download link, attacker-controlled script could execute in the security context of the Pandora application, potentially allowing access to application data or actions using the victim&#39;s session.</p> <p>The patch prevents the issue by explicitly returning PDF downloads with Content-Type: application/pdf, forcing Content-Disposition: attachment, and assigning a trusted .pdf filename based on the task UUID.</p> <p>Pandora is affected by a stored cross-site scripting vulnerability in the PDF download functionality. The /task-download/&lt;task_id&gt;/.../pdf endpoint verifies that the submitted file is a PDF using Pandora&#39;s content-based file-type detection, but previously returned the file using send_file(task.file.path) without explicitly specifying the MIME type or forcing it to be downloaded as an attachment.</p> <p>Because Flask determines the response MIME type from the filename when a path is supplied, an attacker could submit a file whose content is recognized by Pandora as a PDF while its filename or extension causes the download endpoint to return it with a different, potentially active MIME type.</p> <p>A specially crafted PDF/polyglot file could therefore be served inline and interpreted by a victim&#39;s browser as HTML or another executable web format. If a victim with access to the submitted analysis follows the PDF download link, attacker-controlled script could execute in the security context of the Pandora application, potentially allowing access to application data or actions using the victim&#39;s session.</p> <p>The patch prevents the issue by explicitly returning PDF downloads with Content-Type: application/pdf, forcing Content-Disposition: attachment, and assigning a trusted .pdf filename based on the task UUID.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-75529 https://vulnerability.circl.lu/vuln/gcve-1-2026-20132 <p><strong>Affected:</strong> pandora-analysis pandora</p> <p>Pandora is affected by a stored cross-site scripting vulnerability in the PDF download functionality. The /task-download/&lt;task_id&gt;/.../pdf endpoint verifies that the submitted file is a PDF using Pandora&#39;s content-based file-type detection, but previously returned the file using send_file(task.file.path) without explicitly specifying the MIME type or forcing it to be downloaded as an attachment.</p> <p>Because Flask determines the response MIME type from the filename when a path is supplied, an attacker could submit a file whose content is recognized by Pandora as a PDF while its filename or extension causes the download endpoint to return it with a different, potentially active MIME type.</p> <p>A specially crafted PDF/polyglot file could therefore be served inline and interpreted by a victim&#39;s browser as HTML or another executable web format. If a victim with access to the submitted analysis follows the PDF download link, attacker-controlled script could execute in the security context of the Pandora application, potentially allowing access to application data or actions using the victim&#39;s session.</p> <p>The patch prevents the issue by explicitly returning PDF downloads with Content-Type: application/pdf, forcing Content-Disposition: attachment, and assigning a trusted .pdf filename based on the task UUID.</p> <p><strong>Affected:</strong> pandora-analysis pandora</p> <p>Pandora is affected by a stored cross-site scripting vulnerability in the PDF download functionality. The /task-download/&lt;task_id&gt;/.../pdf endpoint verifies that the submitted file is a PDF using Pandora&#39;s content-based file-type detection, but previously returned the file using send_file(task.file.path) without explicitly specifying the MIME type or forcing it to be downloaded as an attachment.</p> <p>Because Flask determines the response MIME type from the filename when a path is supplied, an attacker could submit a file whose content is recognized by Pandora as a PDF while its filename or extension causes the download endpoint to return it with a different, potentially active MIME type.</p> <p>A specially crafted PDF/polyglot file could therefore be served inline and interpreted by a victim&#39;s browser as HTML or another executable web format. If a victim with access to the submitted analysis follows the PDF download link, attacker-controlled script could execute in the security context of the Pandora application, potentially allowing access to application data or actions using the victim&#39;s session.</p> <p>The patch prevents the issue by explicitly returning PDF downloads with Content-Type: application/pdf, forcing Content-Disposition: attachment, and assigning a trusted .pdf filename based on the task UUID.</p> https://vulnerability.circl.lu/vuln/gcve-1-2026-20132