CVE-2026-26272: Homebox Stored XSS Vulnerability

CVE-2026-26272 Overview

CVE-2026-26272 is a stored cross-site scripting (XSS) vulnerability in HomeBox, a home inventory and organization system. The vulnerability exists in the item attachment upload functionality, where the application fails to properly validate or restrict uploaded file types. This allows an authenticated user to upload malicious HTML or SVG files containing executable JavaScript, which then executes in the context of the application's origin when accessed by other users.

Critical Impact

Authenticated attackers can upload malicious files that execute JavaScript in victims' browsers, potentially leading to session hijacking, data theft, or unauthorized actions within the HomeBox application.

Affected Products

• Sysadminsmedia HomeBox versions prior to 0.24.0-rc.1

Discovery Timeline

• 2026-03-03 - CVE-2026-26272 published to NVD
• 2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-26272

Vulnerability Analysis

This stored XSS vulnerability stems from insufficient input validation in the file upload mechanism of HomeBox. When users upload attachments to inventory items, the application does not enforce restrictions on file types that could contain executable content. File formats such as HTML and SVG can embed JavaScript code that executes when the file is rendered by a web browser.

The attack requires authentication, meaning an attacker must have valid credentials to the HomeBox instance. However, once a malicious file is uploaded, it persists on the server and can affect any user who accesses the attachment through direct links. The JavaScript executes within the same origin as the HomeBox application, granting the malicious script access to session cookies, DOM content, and the ability to perform actions on behalf of the victim.

Root Cause

The root cause of CVE-2026-26272 is the lack of proper file type validation and content sanitization in the attachment upload handler. The application accepts file uploads without verifying that the content type is safe for direct browser rendering. Additionally, uploaded files are served without appropriate Content-Disposition headers that would force downloads rather than inline rendering.

Attack Vector

The attack is network-based and requires low privileges (authenticated user access). An attacker uploads a crafted SVG or HTML file containing malicious JavaScript to an inventory item attachment. When another user clicks on the attachment link, their browser renders the file and executes the embedded script. The malicious script runs with the same permissions as the HomeBox application, enabling session theft, phishing overlays, or automated actions against the victim's account.

The vulnerability mechanism involves crafting an SVG file with embedded <script> tags or event handlers (such as onload), or an HTML file with inline JavaScript. When served directly by the application without proper Content-Type headers or download enforcement, browsers interpret and execute the embedded code. For detailed technical analysis, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-26272

Indicators of Compromise

• Uploaded attachments with .svg, .html, or .htm extensions containing script content
• Attachment files with suspicious embedded JavaScript patterns such as <script>, onerror=, onload=, or javascript: URIs
• Unusual access patterns to attachment URLs from unexpected IP addresses
• Session anomalies or unauthorized actions following attachment access

Detection Strategies

• Implement file upload monitoring to flag HTML and SVG file uploads to the attachments directory
• Deploy web application firewall (WAF) rules to detect script injection patterns in uploaded content
• Enable logging of attachment access events with user agent and referrer information
• Use content inspection tools to scan uploaded files for embedded executable content

Monitoring Recommendations

• Monitor server logs for requests to attachment endpoints containing suspicious file extensions
• Set up alerts for multiple failed authentication attempts followed by successful attachment uploads
• Track cross-user access patterns to uploaded attachments that may indicate exploitation attempts
• Review application logs for unexpected JavaScript errors that may indicate XSS payload execution failures

How to Mitigate CVE-2026-26272

Immediate Actions Required

• Upgrade HomeBox to version 0.24.0-rc.1 or later immediately
• Audit existing attachments for potentially malicious HTML, SVG, or other script-capable file types
• Remove or quarantine any suspicious uploaded files identified during the audit
• Notify users to avoid accessing unknown or suspicious attachment links until the patch is applied

Patch Information

The vulnerability is fixed in HomeBox version 0.24.0-rc.1. The patch implements proper file type validation and content handling for uploaded attachments. For detailed patch changes, refer to the GitHub commit. The security advisory with additional context is available at GHSA-55fv-9q6q-vpcr.

Workarounds

• Configure a reverse proxy to set Content-Disposition: attachment headers for all files served from the attachments directory, forcing downloads instead of inline rendering
• Implement allowlist-based file type restrictions at the web server level, blocking HTML, SVG, and other script-capable formats
• Use Content Security Policy (CSP) headers to restrict script execution from attachment paths
• Restrict attachment upload permissions to trusted users only until patching is completed

# Nginx configuration to force attachment downloads
location /attachments/ {
    add_header Content-Disposition "attachment" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Content-Security-Policy "script-src 'none'" always;
}