Vulnerability-Lookup

CVE-2026-48788 (GCVE-0-2026-48788)

Vulnerability from cvelistv5 – Published: 2026-06-16 22:29 – Updated: 2026-06-17 13:20

Title

Remark42: Cross-Site Scripting (XSS) on /api/v1/img via content-type spoofing

Summary

Remark42 is a self-hosted comment engine for blogs, articles, or any other place where readers can add comments. Versions 1.6.0 through 1.15.0 contain a Cross-Site Scripting (XSS) vulnerability exploitable through content-type spoofing. The Remark42 image proxy fetches an arbitrary remote URL and re-serves the response from Remark42's own origin. During the download phase, the proxy determines whether the resource is an image by inspecting only the Content-Type header advertised by the remote server, never examining the actual bytes; during the serving phase, it instead derives the response Content-Type by sniffing those bytes with http.DetectContentType. An attacker can exploit this inconsistency by hosting a URL that advertises Content-Type: image/png while returning an HTML/JavaScript body: the download check accepts it as an image, the serving path sniffs the body and emits Content-Type: text/html, and the browser renders the attacker-controlled HTML/JavaScript as a document within Remark42's origin. Exploitation requires no Remark42 account on the target instance; the attacker only needs to host the malicious upstream URL and deliver the proxy link to a victim by any means, such as email, direct message, or a link on another website. This issue has been fixed in version 1.16.0.

Severity

8.2 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-17 13:19 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-436 - Interpretation Conflict

Assigner

GitHub_M mitre root Scorecard

References

3 references

URL	Tags
https://github.com/umputun/remark42/security/advi…	x_refsource_CONFIRM
https://github.com/umputun/remark42/commit/78d6de…	x_refsource_MISC
https://github.com/umputun/remark42/releases/tag/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
umputun	remark42	Affected: >= 1.6.0, < 1.16.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48788",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-17T13:19:50.596883Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-17T13:20:11.543Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/umputun/remark42/security/advisories/GHSA-4c8j-mgm4-qqvp"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "remark42",
          "vendor": "umputun",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.6.0, \u003c 1.16.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Remark42 is a self-hosted comment engine for blogs, articles, or any other place where readers can add comments. Versions 1.6.0 through 1.15.0 contain a Cross-Site Scripting (XSS) vulnerability exploitable through content-type spoofing. The Remark42 image proxy fetches an arbitrary remote URL and re-serves the response from Remark42\u0027s own origin. During the download phase, the proxy determines whether the resource is an image by inspecting only the Content-Type header advertised by the remote server, never examining the actual bytes; during the serving phase, it instead derives the response Content-Type by sniffing those bytes with http.DetectContentType. An attacker can exploit this inconsistency by hosting a URL that advertises Content-Type: image/png while returning an HTML/JavaScript body: the download check accepts it as an image, the serving path sniffs the body and emits Content-Type: text/html, and the browser renders the attacker-controlled HTML/JavaScript as a document within Remark42\u0027s origin. Exploitation requires no Remark42 account on the target instance; the attacker only needs to host the malicious upstream URL and deliver the proxy link to a victim by any means, such as email, direct message, or a link on another website. This issue has been fixed in version 1.16.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-436",
              "description": "CWE-436: Interpretation Conflict",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-16T22:29:38.877Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/umputun/remark42/security/advisories/GHSA-4c8j-mgm4-qqvp",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/umputun/remark42/security/advisories/GHSA-4c8j-mgm4-qqvp"
        },
        {
          "name": "https://github.com/umputun/remark42/commit/78d6de6bce1e961f023969da3ec8a00dd80c9ae8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/umputun/remark42/commit/78d6de6bce1e961f023969da3ec8a00dd80c9ae8"
        },
        {
          "name": "https://github.com/umputun/remark42/releases/tag/v1.16.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/umputun/remark42/releases/tag/v1.16.0"
        }
      ],
      "source": {
        "advisory": "GHSA-4c8j-mgm4-qqvp",
        "discovery": "UNKNOWN"
      },
      "title": "Remark42: Cross-Site Scripting (XSS) on /api/v1/img via content-type spoofing"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-48788",
    "datePublished": "2026-06-16T22:29:38.877Z",
    "dateReserved": "2026-05-22T20:18:20.365Z",
    "dateUpdated": "2026-06-17T13:20:11.543Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-48788",
      "date": "2026-10-01",
      "epss": "0.00406",
      "percentile": "0.32476"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "remark42",
                "vendor": "umputun",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 1.6.0, \u003c 1.16.0"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Remark42 is a self-hosted comment engine for blogs, articles, or any other place where readers can add comments. Versions 1.6.0 through 1.15.0 contain a Cross-Site Scripting (XSS) vulnerability exploitable through content-type spoofing. The Remark42 image proxy fetches an arbitrary remote URL and re-serves the response from Remark42\u0027s own origin. During the download phase, the proxy determines whether the resource is an image by inspecting only the Content-Type header advertised by the remote server, never examining the actual bytes; during the serving phase, it instead derives the response Content-Type by sniffing those bytes with http.DetectContentType. An attacker can exploit this inconsistency by hosting a URL that advertises Content-Type: image/png while returning an HTML/JavaScript body: the download check accepts it as an image, the serving path sniffs the body and emits Content-Type: text/html, and the browser renders the attacker-controlled HTML/JavaScript as a document within Remark42\u0027s origin. Exploitation requires no Remark42 account on the target instance; the attacker only needs to host the malicious upstream URL and deliver the proxy link to a victim by any means, such as email, direct message, or a link on another website. This issue has been fixed in version 1.16.0."
          }
        ],
        "id": "CVE-2026-48788",
        "lastModified": "2026-06-17T16:28:34.830",
        "metrics": {
          "cvssMetricV30": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 8.2,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
                "version": "3.0"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 4.7,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-48788",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-17T13:19:50.596883Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-06-17T13:20:43.490",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/umputun/remark42/commit/78d6de6bce1e961f023969da3ec8a00dd80c9ae8"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/umputun/remark42/releases/tag/v1.16.0"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/umputun/remark42/security/advisories/GHSA-4c8j-mgm4-qqvp"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/umputun/remark42/security/advisories/GHSA-4c8j-mgm4-qqvp"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-79"
              },
              {
                "lang": "en",
                "value": "CWE-436"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-07-30T16:44:07Z",
      "cve": "CVE-2026-48788",
      "id": "CVE-2026-48788",
      "initial_release_date": "2026-07-30T16:44:07Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-48788",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-48788.json",
      "version": "2"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-48788",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-06-17T13:19:50.596883Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-06-17T13:19:23.500Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/umputun/remark42/security/advisories/GHSA-4c8j-mgm4-qqvp"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "remark42",
              "vendor": "umputun",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 1.6.0, \u003c 1.16.0"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Remark42 is a self-hosted comment engine for blogs, articles, or any other place where readers can add comments. Versions 1.6.0 through 1.15.0 contain a Cross-Site Scripting (XSS) vulnerability exploitable through content-type spoofing. The Remark42 image proxy fetches an arbitrary remote URL and re-serves the response from Remark42\u0027s own origin. During the download phase, the proxy determines whether the resource is an image by inspecting only the Content-Type header advertised by the remote server, never examining the actual bytes; during the serving phase, it instead derives the response Content-Type by sniffing those bytes with http.DetectContentType. An attacker can exploit this inconsistency by hosting a URL that advertises Content-Type: image/png while returning an HTML/JavaScript body: the download check accepts it as an image, the serving path sniffs the body and emits Content-Type: text/html, and the browser renders the attacker-controlled HTML/JavaScript as a document within Remark42\u0027s origin. Exploitation requires no Remark42 account on the target instance; the attacker only needs to host the malicious upstream URL and deliver the proxy link to a victim by any means, such as email, direct message, or a link on another website. This issue has been fixed in version 1.16.0."
            }
          ],
          "metrics": [
            {
              "cvssV3_0": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 8.2,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
                "version": "3.0"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-79",
                  "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-436",
                  "description": "CWE-436: Interpretation Conflict",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-06-16T22:29:38.877Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/umputun/remark42/security/advisories/GHSA-4c8j-mgm4-qqvp",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/umputun/remark42/security/advisories/GHSA-4c8j-mgm4-qqvp"
            },
            {
              "name": "https://github.com/umputun/remark42/commit/78d6de6bce1e961f023969da3ec8a00dd80c9ae8",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/umputun/remark42/commit/78d6de6bce1e961f023969da3ec8a00dd80c9ae8"
            },
            {
              "name": "https://github.com/umputun/remark42/releases/tag/v1.16.0",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/umputun/remark42/releases/tag/v1.16.0"
            }
          ],
          "source": {
            "advisory": "GHSA-4c8j-mgm4-qqvp",
            "discovery": "UNKNOWN"
          },
          "title": "Remark42: Cross-Site Scripting (XSS) on /api/v1/img via content-type spoofing"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-48788",
        "datePublished": "2026-06-16T22:29:38.877Z",
        "dateReserved": "2026-05-22T20:18:20.365Z",
        "dateUpdated": "2026-06-17T13:20:11.543Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-48788

Vulnerability from fkie_nvd - Published: 2026-06-17 13:20 - Updated: 2026-06-17 16:28

Severity

8.2 (High) - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/umputun/remark42/commit/78d6de6bce1e961f023969da3ec8a00dd80c9ae8
	security-advisories@github.com	https://github.com/umputun/remark42/releases/tag/v1.16.0
	security-advisories@github.com	https://github.com/umputun/remark42/security/advisories/GHSA-4c8j-mgm4-qqvp
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/umputun/remark42/security/advisories/GHSA-4c8j-mgm4-qqvp

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "remark42",
          "vendor": "umputun",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.6.0, \u003c 1.16.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Remark42 is a self-hosted comment engine for blogs, articles, or any other place where readers can add comments. Versions 1.6.0 through 1.15.0 contain a Cross-Site Scripting (XSS) vulnerability exploitable through content-type spoofing. The Remark42 image proxy fetches an arbitrary remote URL and re-serves the response from Remark42\u0027s own origin. During the download phase, the proxy determines whether the resource is an image by inspecting only the Content-Type header advertised by the remote server, never examining the actual bytes; during the serving phase, it instead derives the response Content-Type by sniffing those bytes with http.DetectContentType. An attacker can exploit this inconsistency by hosting a URL that advertises Content-Type: image/png while returning an HTML/JavaScript body: the download check accepts it as an image, the serving path sniffs the body and emits Content-Type: text/html, and the browser renders the attacker-controlled HTML/JavaScript as a document within Remark42\u0027s origin. Exploitation requires no Remark42 account on the target instance; the attacker only needs to host the malicious upstream URL and deliver the proxy link to a victim by any means, such as email, direct message, or a link on another website. This issue has been fixed in version 1.16.0."
    }
  ],
  "id": "CVE-2026-48788",
  "lastModified": "2026-06-17T16:28:34.830",
  "metrics": {
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
          "version": "3.0"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-48788",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-17T13:19:50.596883Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-17T13:20:43.490",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/umputun/remark42/commit/78d6de6bce1e961f023969da3ec8a00dd80c9ae8"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/umputun/remark42/releases/tag/v1.16.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/umputun/remark42/security/advisories/GHSA-4c8j-mgm4-qqvp"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/umputun/remark42/security/advisories/GHSA-4c8j-mgm4-qqvp"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        },
        {
          "lang": "en",
          "value": "CWE-436"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-4C8J-MGM4-QQVP

Vulnerability from github – Published: 2026-06-26 19:26 – Updated: 2026-06-26 19:26

Summary

Remark42: Cross-Site Scripting (XSS) on /api/v1/img via content-type spoofing

Details

Summary

The remark42 image proxy fetches an arbitrary remote URL and re-serves the response from remark42's own origin. The download path decides whether the fetched resource is an image by looking only at the Content-Type header the remote server claims — it never inspects the actual bytes. The serving path then derives the response Content-Type by sniffing those bytes with http.DetectContentType.

An attacker hosts a URL that sets Content-Type to image/png but returns an HTML/JavaScript body:

the download check sees image/png → accepts it;
the serve path sniffs the body → emits Content-Type: text/html;
the browser renders attacker HTML/JS as a document in remark42's origin.

Details

Downloader

backend/app/rest/proxy/image.go — downloadImage(), lines 189-206:

contentType := resp.Header.Get("Content-Type")
if !strings.HasPrefix(contentType, "image/") {
    return nil, fmt.Errorf("invalid content type %s", contentType)
}

maxSize := 5 * 1024 * 1024 // 5MB default
if p.ImageService != nil && p.ImageService.MaxSize > 0 {
    maxSize = p.ImageService.MaxSize
}
lr := io.LimitReader(resp.Body, int64(maxSize)+1)
imgData, err := io.ReadAll(lr)
if err != nil {
    return nil, fmt.Errorf("unable to read image body: %w", err)
}
if len(imgData) > maxSize {
    return nil, fmt.Errorf("image is too large")
}
return imgData, nil          // <-- bytes never validated, returned as-is

Send Content-Type: image/png and the check passes regardless of what the body actually contains.

Server

backend/app/rest/proxy/image.go — Handler(), line 131:

w.Header().Add("Content-Type", p.ImageService.ImgContentType(img))
_, err = io.Copy(w, bytes.NewReader(img))

backend/app/store/image/image.go — ImgContentType(), lines 242-249:

func (s *Service) ImgContentType(img []byte) string {
    contentType := http.DetectContentType(img)
    if contentType == "application/octet-stream" {
        return "image/*"
    }
    return contentType                 // <-- returns text/html for an HTML body
}

PoC

self.send_response(200)
self.send_header("Content-Type", "image/png")
self.send_header("Content-Length", str(len(body)))
self.end_headers()
self.wfile.write(body)            # body = <!DOCTYPE html><script>...</script>

Then have the victim open https://<remark42-host>/api/v1/img?src=<base64(attacker-host)> top-level.

Impact

The script can issue authenticated, same-origin API calls with credentials: 'include' — the JWT cookie is sent automatically.
The script can read the XSRF-TOKEN cookie and re-send it as the X-XSRF-TOKEN header, defeating CSRF protection. The attacker acts as the victim: delete/edit their comments, change their settings, and — if the victim is admin — perform admin actions.

Triggering requires no remark42 account on the target instance; the attacker only needs to host the malicious upstream URL and deliver the proxy link to a victim by any means (email, DM, link on another site, etc.).

Fix

v1.16.0 adds layered defense to /api/v1/img and /api/v1/picture/{user}/{id}:

rest.SafeImgContentType validates sniffed body bytes against a strict allowlist (image/png, image/jpeg, image/gif, image/webp, image/bmp, image/x-icon). Non-image content returns 415 with no body echo. SVG is implicitly excluded.
Every response carries Content-Security-Policy: default-src 'none'; sandbox; frame-ancestors 'none', X-Content-Type Options: nosniff, and Content-Disposition: inline; filename="image".
The ETag is bumped to "v2:<base64(src)>". Browsers that revalidate cached pre-fix responses get a fresh validated 200 instead of a 304 against the poisoned cached entry.
The strict default-src 'none'; sandbox CSP also applies to all /api/v1/* routes as defense-in-depth.

Residual exposure

Browser-local caches that already hold a pre-fix text/html response with Cache-Control: max-age=2592000 keep serving it from local store until the TTL expires or the cache is evicted under memory pressure. The ETag bump only reaches clients that revalidate during the cached lifetime. Operators running a CDN/edge cache in front of remark42 should purge /api/v1/img after deploying v1.16.0.

Severity

8.2 (High)


                  
                    CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/umputun/remark42"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.6.0"
            },
            {
              "fixed": "1.16.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-48788"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-436",
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-26T19:26:43Z",
    "nvd_published_at": "2026-06-17T13:20:43Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nThe remark42 image proxy fetches an arbitrary remote URL and re-serves the response from remark42\u0027s own origin. The download path decides whether the fetched resource is an image by looking only at the `Content-Type` header the remote server claims \u2014 it never inspects the actual bytes. The serving path then derives the response `Content-Type` by sniffing those bytes with `http.DetectContentType`.\n\nAn attacker hosts a URL that sets `Content-Type` to `image/png` but returns an HTML/JavaScript body:\n\n* the download check sees `image/png` \u2192 accepts it;\n* the serve path sniffs the body \u2192 emits `Content-Type: text/html`;\n* the browser renders attacker HTML/JS as a document in remark42\u0027s origin.\n\n### Details\n#### Downloader\n\n`backend/app/rest/proxy/image.go` \u2014 `downloadImage()`, lines 189-206:\n\n```go\ncontentType := resp.Header.Get(\"Content-Type\")\nif !strings.HasPrefix(contentType, \"image/\") {\n    return nil, fmt.Errorf(\"invalid content type %s\", contentType)\n}\n\nmaxSize := 5 * 1024 * 1024 // 5MB default\nif p.ImageService != nil \u0026\u0026 p.ImageService.MaxSize \u003e 0 {\n    maxSize = p.ImageService.MaxSize\n}\nlr := io.LimitReader(resp.Body, int64(maxSize)+1)\nimgData, err := io.ReadAll(lr)\nif err != nil {\n    return nil, fmt.Errorf(\"unable to read image body: %w\", err)\n}\nif len(imgData) \u003e maxSize {\n    return nil, fmt.Errorf(\"image is too large\")\n}\nreturn imgData, nil          // \u003c-- bytes never validated, returned as-is\n```\n\nSend `Content-Type: image/png` and the check passes regardless of what the body actually contains.\n\n#### Server\n\n`backend/app/rest/proxy/image.go` \u2014 `Handler()`, line 131:\n\n```go\nw.Header().Add(\"Content-Type\", p.ImageService.ImgContentType(img))\n_, err = io.Copy(w, bytes.NewReader(img))\n```\n\n`backend/app/store/image/image.go` \u2014 `ImgContentType()`, lines 242-249:\n\n```go\nfunc (s *Service) ImgContentType(img []byte) string {\n    contentType := http.DetectContentType(img)\n    if contentType == \"application/octet-stream\" {\n        return \"image/*\"\n    }\n    return contentType                 // \u003c-- returns text/html for an HTML body\n}\n```\n\n### PoC\n\n```python\nself.send_response(200)\nself.send_header(\"Content-Type\", \"image/png\")\nself.send_header(\"Content-Length\", str(len(body)))\nself.end_headers()\nself.wfile.write(body)            # body = \u003c!DOCTYPE html\u003e\u003cscript\u003e...\u003c/script\u003e\n```\n\nThen have the victim open `https://\u003cremark42-host\u003e/api/v1/img?src=\u003cbase64(attacker-host)\u003e` top-level.\n\n### Impact\n* The script can issue authenticated, same-origin API calls with `credentials: \u0027include\u0027` \u2014 the JWT cookie is sent automatically.\n* The script can read the `XSRF-TOKEN` cookie and re-send it as the `X-XSRF-TOKEN` header, defeating CSRF protection. The attacker acts as the victim: delete/edit their comments, change their settings, and \u2014 if the victim is admin \u2014 perform admin actions.\n\nTriggering requires no remark42 account on the target instance; the attacker only needs to host the malicious upstream URL and deliver the proxy link to a victim by any means (email, DM, link on another site, etc.).\n\n### Fix\n\n`v1.16.0` adds layered defense to `/api/v1/img` and `/api/v1/picture/{user}/{id}`:\n\n* `rest.SafeImgContentType` validates sniffed body bytes against a strict allowlist (`image/png`, `image/jpeg`, `image/gif`, `image/webp`, `image/bmp`, `image/x-icon`). Non-image content returns `415` with no body echo. SVG is implicitly excluded.\n* Every response carries `Content-Security-Policy: default-src \u0027none\u0027; sandbox; frame-ancestors \u0027none\u0027`, `X-Content-Type Options: nosniff`, and `Content-Disposition: inline; filename=\"image\"`.\n* The ETag is bumped to `\"v2:\u003cbase64(src)\u003e\"`. Browsers that revalidate cached pre-fix responses get a fresh validated `200` instead of a `304` against the poisoned cached entry.\n* The strict `default-src \u0027none\u0027; sandbox` CSP also applies to all `/api/v1/*` routes as defense-in-depth.\n\n#### Residual exposure\n\nBrowser-local caches that already hold a pre-fix `text/html` response with `Cache-Control: max-age=2592000` keep serving it from local store until the TTL expires or the cache is evicted under memory pressure. The ETag bump only reaches clients that revalidate during the cached lifetime. Operators running a CDN/edge cache in front of remark42 should purge `/api/v1/img` after deploying `v1.16.0`.",
  "id": "GHSA-4c8j-mgm4-qqvp",
  "modified": "2026-06-26T19:26:44Z",
  "published": "2026-06-26T19:26:43Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/umputun/remark42/security/advisories/GHSA-4c8j-mgm4-qqvp"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48788"
    },
    {
      "type": "WEB",
      "url": "https://github.com/umputun/remark42/commit/78d6de6bce1e961f023969da3ec8a00dd80c9ae8"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/umputun/remark42"
    },
    {
      "type": "WEB",
      "url": "https://github.com/umputun/remark42/releases/tag/v1.16.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Remark42: Cross-Site Scripting (XSS) on /api/v1/img via content-type spoofing"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-48788 (GCVE-0-2026-48788)

FKIE_CVE-2026-48788

GHSA-4C8J-MGM4-QQVP

Summary

Details

Downloader

Server

PoC

Impact

Fix

Residual exposure

Tags

Sightings

Nomenclature

Related by attack behaviour