CVE-2026-28274: Initiative Platform Stored XSS Vulnerability

CVE-2026-28274 Overview

CVE-2026-28274 is a Stored Cross-Site Scripting (XSS) vulnerability in Initiative, a self-hosted project management platform. The vulnerability exists in the document upload functionality, where users with upload permissions within the "Initiatives" section can upload malicious .html or .htm files. Because uploaded HTML files are served under the application's origin without proper sandboxing, embedded JavaScript executes in the context of the application, enabling attackers to exfiltrate authentication tokens, session cookies, and other sensitive data.

Critical Impact
Attackers can steal authentication credentials and session tokens by tricking users into accessing malicious HTML files uploaded to the platform, potentially compromising all user accounts.

Affected Products

Initiative versions prior to 0.32.4

Discovery Timeline

2026-02-26 - CVE CVE-2026-28274 published to NVD
2026-02-26 - Last updated in NVD database

Technical Details for CVE-2026-28274

Vulnerability Analysis

This Stored XSS vulnerability arises from inadequate input validation and content security controls in Initiative's document upload feature. The application fails to properly sanitize or sandbox user-uploaded HTML files, allowing them to be served directly under the application's origin domain. When a victim accesses such a malicious file—either through a shared link or by browsing uploaded documents—the embedded JavaScript executes with full access to the application's context.

The vulnerability is particularly dangerous because it persists on the server (stored XSS), meaning the malicious payload remains active until the file is removed. Any user who views the malicious document becomes a potential victim, regardless of their role or permissions in the system.

Root Cause

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation). The Initiative application lacks proper content-type enforcement and sandboxing mechanisms for uploaded files. Specifically, when HTML files are uploaded through the document upload functionality, the application serves them with their original content type rather than forcing a download or rendering them in an isolated iframe with appropriate sandbox attributes. This allows JavaScript within the uploaded files to execute in the same security context as the main application.

Attack Vector

The attack exploits the network-accessible document upload feature. An attacker with basic upload permissions within an Initiative project can perform the following attack sequence:

Create a malicious HTML file containing JavaScript designed to exfiltrate sensitive data such as cookies, localStorage tokens, or form data
Upload the file through the "Initiatives" section document upload functionality
Share the direct link to the uploaded file with potential victims or wait for other users to browse the documents
When victims access the link, the malicious JavaScript executes in their browser session under the application's origin
The script can then transmit authentication tokens and session cookies to an attacker-controlled server

Since the uploaded file is hosted under the application's domain, the browser's same-origin policy grants the malicious script full access to the application's cookies and storage mechanisms. User interaction is required—the victim must click the link or navigate to the malicious file—but the attack can be made convincing through social engineering within project collaboration contexts.

Detection Methods for CVE-2026-28274

Indicators of Compromise

Unusual HTML or HTM file uploads in the document repository, particularly files with embedded <script> tags or event handlers
Outbound network requests from client browsers to unknown external domains after viewing uploaded documents
Unexpected JavaScript execution errors in browser console logs when accessing document links

Detection Strategies

Implement content security policy (CSP) monitoring to detect violations indicating unauthorized script execution
Monitor server access logs for requests to uploaded HTML files followed by suspicious external requests
Review uploaded document contents for known XSS payload patterns including script tags, event handlers, and data URI schemes
Enable browser-side XSS auditor logs where available to capture reflected or stored XSS attempts

Monitoring Recommendations

Configure web application firewall (WAF) rules to alert on HTML file uploads containing JavaScript
Establish baseline metrics for document upload activity and alert on anomalies
Monitor for authentication token usage from unexpected IP addresses, which may indicate successful credential theft

How to Mitigate CVE-2026-28274

Immediate Actions Required

Upgrade Initiative to version 0.32.4 or later immediately
Audit existing uploaded documents for suspicious HTML files containing JavaScript
Review access logs to identify users who may have accessed potentially malicious files
Consider forcing re-authentication for all users if compromise is suspected

Patch Information

The vulnerability is fixed in Initiative version 0.32.4. The patch addresses the improper handling of uploaded HTML files by implementing proper sandboxing and content security controls. For detailed information about the fix, refer to the GitHub Release v0.32.4 and the GitHub Security Advisory GHSA-v38c-x27x-p584.

Workarounds

Temporarily disable HTML file uploads by restricting allowed file types at the application or web server level
Configure the web server to force Content-Disposition: attachment for all uploaded files, preventing browser rendering
Implement a Content Security Policy header with strict script-src directives to block inline script execution
Restrict document upload permissions to trusted users only until the patch can be applied

bash

# Nginx configuration to force download of uploaded HTML files
location /uploads/ {
    add_header Content-Disposition "attachment" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Content-Security-Policy "default-src 'none'" always;
}