CVE-2026-1466: Jirafeau XSS Vulnerability

CVE-2026-1466 Overview

CVE-2026-1466 is a Cross-Site Scripting (XSS) vulnerability in Jirafeau, an open-source file sharing application. The vulnerability allows attackers to bypass the application's MIME type validation mechanism, which was designed to prevent browser preview of potentially dangerous file types such as SVG and HTML documents. By sending manipulated HTTP requests with invalid MIME types (e.g., image without a subtype), attackers can trick browsers into auto-detecting the MIME type of uploaded files, potentially executing malicious JavaScript code embedded in SVG files.

Critical Impact

Attackers can execute arbitrary JavaScript in victims' browsers through crafted SVG files, potentially leading to session hijacking, credential theft, and unauthorized actions on behalf of authenticated users.

Affected Products

• Jirafeau (versions prior to the security patch)

Discovery Timeline

• 2026-01-28 - CVE CVE-2026-1466 published to NVD
• 2026-01-29 - Last updated in NVD database

Technical Details for CVE-2026-1466

Vulnerability Analysis

This vulnerability represents a MIME type validation bypass that undermines Jirafeau's existing XSS protections. Jirafeau implements a safeguard that stores uploaded files' MIME types and only permits browser preview for types beginning with image (excluding image/svg+xml), video, and audio. This restriction was specifically designed to prevent XSS attacks via SVG and HTML file uploads, as documented in previous related vulnerabilities (CVE-2022-30110, CVE-2024-12326, and CVE-2025-7066).

The core issue lies in how the application handles malformed MIME types. When an attacker submits a request with an incomplete or invalid MIME type such as image (without the required subtype component like /png or /jpeg), the validation logic incorrectly treats this as a permitted image type. Subsequently, when a victim's browser attempts to preview the file, it performs MIME sniffing—automatically detecting the actual content type by examining the file contents—and correctly identifies the file as an SVG, which then executes any embedded JavaScript.

Root Cause

The root cause is insufficient validation of MIME type format during the file upload and preview process. The application's regex or string-matching logic checked if the MIME type "begins with image" but did not verify the presence of a valid subtype delimiter and subtype. This allowed truncated MIME types to pass validation while still triggering browser MIME sniffing during preview.

Attack Vector

The attack requires user interaction where a victim must preview a maliciously crafted file. An attacker uploads an SVG file containing JavaScript code while manipulating the HTTP request to specify an invalid MIME type like image. When shared with a victim who clicks the preview link, the browser detects the actual SVG MIME type and renders the file, executing the embedded script within the context of the Jirafeau domain.

The attack flow involves the following steps:

1. Attacker crafts an SVG file with embedded malicious JavaScript
2. Attacker uploads the file while intercepting and modifying the HTTP request to set an invalid MIME type (image)
3. The application accepts the file as it appears to be an allowed image type
4. Attacker shares the preview link with potential victims
5. When victims access the preview, their browsers sniff the content and identify it as SVG
6. The embedded JavaScript executes in the victim's browser context

Detection Methods for CVE-2026-1466

Indicators of Compromise

• HTTP requests to Jirafeau with malformed Content-Type headers containing incomplete MIME types (e.g., image, video, audio without subtype)
• Uploaded files with .svg or .html extensions but non-standard MIME type assignments in the application database
• Server logs showing preview requests for files that subsequently trigger JavaScript execution errors or suspicious behavior

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block HTTP requests with invalid or incomplete MIME type formats
• Monitor application logs for file uploads where the stored MIME type doesn't match the file extension or detected content
• Deploy browser-based XSS detection mechanisms to identify script execution from unexpected origins

Monitoring Recommendations

• Review access logs for patterns indicating exploitation attempts, particularly repeated preview requests from different IP addresses to the same file
• Establish alerts for files uploaded with MIME types that don't contain a forward slash separator
• Monitor for unusual outbound connections or data exfiltration attempts that may indicate successful XSS exploitation

How to Mitigate CVE-2026-1466

Immediate Actions Required

• Apply the security patch available in the GitLab commit immediately
• Review recently uploaded files for potential malicious SVG or HTML content
• Consider temporarily disabling the file preview functionality until the patch is applied

Patch Information

The fix addresses this vulnerability by implementing the X-Content-Type-Options: nosniff HTTP header when serving file previews. This header instructs browsers to strictly adhere to the declared MIME type and not perform content sniffing, effectively preventing the attack vector. The security patch is available in commit 747afb20bfcff14bb67e40e7035d47a6311ba3e1 on the official Jirafeau GitLab repository.

Workarounds

• Configure your web server or reverse proxy to add the X-Content-Type-Options: nosniff header to all responses from the Jirafeau preview endpoint
• Implement Content Security Policy (CSP) headers to restrict script execution and mitigate XSS impact
• Disable file preview functionality entirely by modifying the application configuration until the official patch can be applied

# Example nginx configuration to add nosniff header
location /f.php {
    add_header X-Content-Type-Options "nosniff" always;
    # existing configuration
}