CVE-2026-14856: TastyIgniter v4.3.0 Stored XSS Vulnerability

CVE-2026-14856 Overview

CVE-2026-14856 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Media Manager file upload functionality of TastyIgniter v4.3.0. The flaw stems from insufficient validation and sanitization of SVG files. An authenticated low-privileged user can upload a malicious SVG containing JavaScript. When an administrator views the file, the script executes in the administrator's browser context.

Critical Impact
Chaining this XSS with a Cross-Site Request Forgery (CSRF) attack allows an attacker to steal the administrator's CSRF token, modify credentials, and take full control of the administrative account.

Affected Products

TastyIgniter v4.3.0
TastyIgniter Media Manager component
Deployments allowing authenticated low-privileged file uploads

Discovery Timeline

2026-07-27 - CVE-2026-14856 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-14856

Vulnerability Analysis

The vulnerability resides in the Media Manager file upload handler in TastyIgniter v4.3.0. The upload routine accepts Scalable Vector Graphics (SVG) files without stripping embedded scripting content. SVG is an XML-based image format that can carry <script> elements and event handler attributes such as onload. When the browser renders the uploaded SVG as an image asset served from the application origin, any embedded JavaScript executes with the privileges of the viewing user.

An authenticated attacker with low privileges (for example, a staff-level account) can weaponize this to target administrators. The payload persists in the media library, so exploitation is stored rather than reflected. Any administrator navigating to the uploaded resource triggers the script in the context of the TastyIgniter admin session.

Root Cause

The root cause is missing server-side sanitization of user-supplied SVG content combined with permissive Content-Type handling. The application does not enforce an allowlist of safe image formats, nor does it strip active content from SVGs before storage or delivery.

Attack Vector

Exploitation requires network access to the TastyIgniter admin panel, valid low-privileged credentials, and user interaction from a privileged victim. The attacker uploads a crafted SVG through the Media Manager. When an administrator opens or previews the file, the JavaScript payload runs in-session. The script can read the anti-CSRF token from the DOM or cookies and issue authenticated requests to endpoints that change administrative credentials, completing a full account takeover.

No verified public proof-of-concept is available. Refer to the INCIBE Security Notice on XSS for advisory details.

Detection Methods for CVE-2026-14856

Indicators of Compromise

SVG files in the Media Manager storage directory containing <script>, onload, onerror, or javascript: strings.
Unexpected POST requests to administrator profile or credential-change endpoints originating immediately after an admin opens a media asset.
New or modified administrator accounts that do not correlate with legitimate change-management activity.
Media uploads submitted by low-privileged staff accounts with .svg extensions.

Detection Strategies

Scan the media upload directory for SVG files and inspect their XML content for scripting elements and event handler attributes.
Correlate web server access logs to identify admin sessions that requested an SVG immediately before privileged state changes.
Alert on password or email changes on administrator accounts that occur within short windows after SVG asset access.

Monitoring Recommendations

Log and review all file uploads through the TastyIgniter Media Manager, capturing uploader identity, MIME type, and file hash.
Monitor administrator authentication events and profile modifications for anomalous sequencing.
Enable browser Content Security Policy (CSP) violation reporting to surface inline script execution attempts.

How to Mitigate CVE-2026-14856

Immediate Actions Required

Restrict Media Manager upload permissions to trusted roles until a vendor patch is applied.
Audit the media library for existing SVG files and remove any containing script content or event handlers.
Rotate administrator credentials and invalidate active sessions if suspicious SVG uploads are found.
Review recent administrator profile and password changes for unauthorized modifications.

Patch Information

At the time of publication, no fixed version is listed in the NVD entry for CVE-2026-14856. Monitor the TastyIgniter project repository and the INCIBE Security Notice on XSS for updates and apply the vendor fix once released.

Workarounds

Disallow SVG uploads in the Media Manager by restricting the accepted MIME types and file extensions to raster formats such as PNG, JPEG, and GIF.
Serve uploaded media from a sandboxed origin or with the Content-Disposition: attachment header to prevent inline browser rendering.
Deploy a strict Content Security Policy that blocks inline scripts and restricts script-src to trusted origins.
Place the admin panel behind IP allowlisting or a Web Application Firewall rule that inspects uploaded SVG payloads for script content.

bash

# Example nginx configuration to force download of SVG assets
location ~* \.svg$ {
    add_header Content-Disposition "attachment";
    add_header Content-Security-Policy "default-src 'none'; script-src 'none'";
    add_header X-Content-Type-Options "nosniff";
}