CVE-2026-33653: Ulloady File Uploader XSS Vulnerability

CVE-2026-33653 Overview

A Stored Cross-Site Scripting (XSS) vulnerability has been identified in Ulloady, a popular file uploader script with multi-file upload support. The vulnerability exists in versions prior to 3.1.2 due to improper sanitization of filenames during the file upload process. An attacker can upload a file with a malicious filename containing JavaScript code, which is later rendered in the application without proper escaping. When the filename is displayed in the file list or file details page, the malicious script executes in the browser of any user who views the page.

Critical Impact
Attackers can execute arbitrary JavaScript in victims' browsers, potentially leading to session hijacking, credential theft, or malicious actions performed on behalf of authenticated users.

Affected Products

Ulloady (farisc0de/Uploady) versions prior to 3.1.2
PhpFileUploading library versions prior to 3.2.4

Discovery Timeline

2026-03-26 - CVE-2026-33653 published to NVD
2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-33653

Vulnerability Analysis

This Stored XSS vulnerability (CWE-79) allows attackers to inject malicious JavaScript code through specially crafted filenames during the file upload process. The root cause lies in the application's failure to properly sanitize or encode filename data before rendering it in HTML contexts. When a user uploads a file with a filename containing JavaScript payloads (e.g., <script>alert('XSS')</script>.txt), the application stores this filename as-is. Subsequently, when other users browse the file list or view file details, the malicious filename is rendered without proper HTML encoding, causing the embedded script to execute in their browsers.

The attack requires authenticated access to upload files but impacts any user who subsequently views the malicious filename in the application interface. This makes it particularly dangerous in multi-user environments where uploaded files are visible to other authenticated users or administrators.

Root Cause

The vulnerability stems from missing input sanitization on the filename parameter during file upload processing, combined with lack of output encoding when displaying filenames in HTML pages. The farisc0de/phpfileuploading library versions prior to 3.2.4 did not properly escape special characters in filenames before rendering them in the web interface.

Attack Vector

The attack vector is network-based and requires the attacker to have authenticated access to the file upload functionality. The attacker uploads a file with a malicious filename containing JavaScript code. This payload is stored persistently and executes whenever another user views the file list or file details page, making this a Stored XSS attack with broader impact potential than Reflected XSS variants.

The security patch updated the underlying farisc0de/phpfileuploading library from version 3.2.3 to 3.2.4 which includes proper filename sanitization:

text

     "packages": [
         {
             "name": "farisc0de/phpfileuploading",
-            "version": "v3.2.3",
+            "version": "v3.2.4",
             "source": {
                 "type": "git",
                 "url": "https://github.com/farisc0de/PhpFileUploading.git",
-                "reference": "fba8943f10fe10410332caa6fcd3d27662f48b40"
+                "reference": "4f123bcae1e510b5452e53af992d227249046716"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/farisc0de/PhpFileUploading/zipball/fba8943f10fe10410332caa6fcd3d27662f48b40",
-                "reference": "fba8943f10fe10410332caa6fcd3d27662f48b40",
+                "url": "https://api.github.com/repos/farisc0de/PhpFileUploading/zipball/4f123bcae1e510b5452e53af992d227249046716",
+                "reference": "4f123bcae1e510b5452e53af992d227249046716",
                 "shasum": ""
             },
             "require": {

Source: GitHub Commit Update

Detection Methods for CVE-2026-33653

Indicators of Compromise

Filenames containing HTML tags or JavaScript code such as <script>, <img onerror=, <svg onload=, or event handlers
Unusual file upload activity with filenames containing encoded characters (%3C, %3E, <)
Web application firewall (WAF) logs showing blocked XSS patterns in file upload requests
User reports of unexpected JavaScript alerts or behavior when viewing file lists

Detection Strategies

Implement WAF rules to detect and block file uploads with filenames containing JavaScript or HTML tags
Monitor web server access logs for file upload requests with suspicious filename patterns
Review application error logs for potential XSS-related encoding issues
Deploy browser-based XSS detection through Content Security Policy (CSP) violation reporting

Monitoring Recommendations

Enable verbose logging for file upload endpoints to capture full filename data
Configure alerting for repeated file upload attempts with special characters in filenames
Implement real-time monitoring for CSP violation reports that may indicate XSS exploitation
Regularly audit stored filenames in the database for potential malicious payloads

How to Mitigate CVE-2026-33653

Immediate Actions Required

Upgrade Ulloady to version 3.1.2 or later immediately
Audit existing uploaded files in the database for filenames containing HTML/JavaScript code
Implement Content Security Policy (CSP) headers to mitigate XSS impact
Review and sanitize any existing malicious filenames in the file storage system

Patch Information

The vulnerability has been fixed in Ulloady version 3.1.2. The fix updates the farisc0de/phpfileuploading dependency from version 3.2.3 to 3.2.4, which implements proper filename sanitization. Users should update via Composer to pull the latest secure version. For more details, refer to the GitHub Security Advisory GHSA-2834 and the GitHub Release v3.1.2.

Workarounds

If immediate patching is not possible, implement server-side filename sanitization that strips or encodes HTML special characters
Deploy a Web Application Firewall (WAF) with rules to block file uploads containing suspicious filename patterns
Implement output encoding (e.g., htmlspecialchars() in PHP) when displaying filenames in the application
Restrict file upload permissions to trusted users only until the patch can be applied

bash

# Update Ulloady via Composer to the patched version
composer update farisc0de/uploady
# Or specify the exact version
composer require farisc0de/uploady:^3.1.2