CVE-2026-28274: Initiative Platform Stored XSS Vulnerability

CVE-2026-28274 Overview

CVE-2026-28274 is a Stored Cross-Site Scripting (XSS) vulnerability in Initiative, a self-hosted project management platform. The vulnerability exists in the document upload functionality, where users with upload permissions within the "Initiatives" section can upload malicious .html or .htm files. Because uploaded HTML files are served under the application's origin without proper sandboxing, embedded JavaScript executes in the context of the application, enabling attackers to exfiltrate authentication tokens, session cookies, and other sensitive data.

Critical Impact

Attackers can steal authentication credentials and session tokens by tricking users into accessing malicious HTML files uploaded to the platform, potentially compromising all user accounts.

Affected Products

• Initiative versions prior to 0.32.4

Discovery Timeline

• 2026-02-26 - CVE CVE-2026-28274 published to NVD
• 2026-02-26 - Last updated in NVD database

Technical Details for CVE-2026-28274

Vulnerability Analysis

This Stored XSS vulnerability arises from inadequate input validation and content security controls in Initiative's document upload feature. The application fails to properly sanitize or sandbox user-uploaded HTML files, allowing them to be served directly under the application's origin domain. When a victim accesses such a malicious file—either through a shared link or by browsing uploaded documents—the embedded JavaScript executes with full access to the application's context.

The vulnerability is particularly dangerous because it persists on the server (stored XSS), meaning the malicious payload remains active until the file is removed. Any user who views the malicious document becomes a potential victim, regardless of their role or permissions in the system.

Root Cause

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation). The Initiative application lacks proper content-type enforcement and sandboxing mechanisms for uploaded files. Specifically, when HTML files are uploaded through the document upload functionality, the application serves them with their original content type rather than forcing a download or rendering them in an isolated iframe with appropriate sandbox attributes. This allows JavaScript within the uploaded files to execute in the same security context as the main application.

Attack Vector

The attack exploits the network-accessible document upload feature. An attacker with basic upload permissions within an Initiative project can perform the following attack sequence:

1. Create a malicious HTML file containing JavaScript designed to exfiltrate sensitive data such as cookies, localStorage tokens, or form data
2. Upload the file through the "Initiatives" section document upload functionality
3. Share the direct link to the uploaded file with potential victims or wait for other users to browse the documents
4. When victims access the link, the malicious JavaScript executes in their browser session under the application's origin
5. The script can then transmit authentication tokens and session cookies to an attacker-controlled server

Since the uploaded file is hosted under the application's domain, the browser's same-origin policy grants the malicious script full access to the application's cookies and storage mechanisms. User interaction is required—the victim must click the link or navigate to the malicious file—but the attack can be made convincing through social engineering within project collaboration contexts.

Detection Methods for CVE-2026-28274

Indicators of Compromise

• Unusual HTML or HTM file uploads in the document repository, particularly files with embedded <script> tags or event handlers
• Outbound network requests from client browsers to unknown external domains after viewing uploaded documents
• Unexpected JavaScript execution errors in browser console logs when accessing document links

Detection Strategies

• Implement content security policy (CSP) monitoring to detect violations indicating unauthorized script execution
• Monitor server access logs for requests to uploaded HTML files followed by suspicious external requests
• Review uploaded document contents for known XSS payload patterns including script tags, event handlers, and data URI schemes
• Enable browser-side XSS auditor logs where available to capture reflected or stored XSS attempts

Monitoring Recommendations

• Configure web application firewall (WAF) rules to alert on HTML file uploads containing JavaScript
• Establish baseline metrics for document upload activity and alert on anomalies
• Monitor for authentication token usage from unexpected IP addresses, which may indicate successful credential theft

How to Mitigate CVE-2026-28274

Immediate Actions Required

• Upgrade Initiative to version 0.32.4 or later immediately
• Audit existing uploaded documents for suspicious HTML files containing JavaScript
• Review access logs to identify users who may have accessed potentially malicious files
• Consider forcing re-authentication for all users if compromise is suspected

Patch Information

The vulnerability is fixed in Initiative version 0.32.4. The patch addresses the improper handling of uploaded HTML files by implementing proper sandboxing and content security controls. For detailed information about the fix, refer to the GitHub Release v0.32.4 and the GitHub Security Advisory GHSA-v38c-x27x-p584.

Workarounds

• Temporarily disable HTML file uploads by restricting allowed file types at the application or web server level
• Configure the web server to force Content-Disposition: attachment for all uploaded files, preventing browser rendering
• Implement a Content Security Policy header with strict script-src directives to block inline script execution
• Restrict document upload permissions to trusted users only until the patch can be applied

# Nginx configuration to force download of uploaded HTML files
location /uploads/ {
    add_header Content-Disposition "attachment" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Content-Security-Policy "default-src 'none'" always;
}