CVE-2026-35608: QuickDrop Stored XSS Vulnerability

CVE-2026-35608 Overview

CVE-2026-35608 is a stored Cross-Site Scripting (XSS) vulnerability affecting QuickDrop, an easy-to-use file sharing application. Prior to version 1.5.3, the application's file preview endpoint fails to properly sanitize SVG file content, allowing attackers to upload malicious SVG files containing embedded JavaScript payloads. When any user views the file preview, the script executes in the context of the application's domain, potentially leading to session hijacking, credential theft, or unauthorized actions on behalf of the victim.

Critical Impact

Attackers can execute arbitrary JavaScript in victims' browsers by uploading malicious SVG files, enabling session hijacking, data theft, and phishing attacks within the application context.

Affected Products

• QuickDrop versions prior to 1.5.3

Discovery Timeline

• 2026-04-07 - CVE-2026-35608 published to NVD
• 2026-04-08 - Last updated in NVD database

Technical Details for CVE-2026-35608

Vulnerability Analysis

This stored XSS vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The vulnerability exists because QuickDrop's file upload functionality via the /api/file/upload-chunk endpoint accepts SVG files without adequate content sanitization. SVG (Scalable Vector Graphics) files are XML-based and can contain embedded <script> tags or event handlers that execute JavaScript when the file is rendered in a browser.

The attack requires no authentication to upload malicious files, though user interaction is required for exploitation—a victim must view the file preview for the payload to execute. The vulnerability allows cross-site impact, affecting users who view the malicious file preview regardless of who uploaded it.

Root Cause

The root cause of this vulnerability is inadequate input validation and content sanitization of uploaded SVG files. The application's /api/file/upload-chunk endpoint accepts SVG files and subsequently serves them for preview without stripping potentially malicious content such as embedded JavaScript, event handlers, or external resource references. When SVG files are rendered inline in a web browser, any embedded scripts execute with the same origin permissions as the application itself.

Attack Vector

An attacker exploits this vulnerability through a network-based attack by uploading a specially crafted SVG file to the QuickDrop application. The attack flow is as follows:

1. The attacker crafts an SVG file containing malicious JavaScript payload (e.g., using <script> tags or onload event handlers)
2. The attacker uploads the malicious SVG file via the /api/file/upload-chunk endpoint
3. The file is stored on the server without sanitization
4. When any user (including administrators) navigates to preview the uploaded file, the malicious JavaScript executes in their browser
5. The script runs in the context of the application's domain, allowing access to cookies, session tokens, and the ability to perform actions as the victim

This is a stored XSS attack, meaning the payload persists on the server and affects all users who view the compromised file preview.

Detection Methods for CVE-2026-35608

Indicators of Compromise

• Presence of SVG files containing <script> tags, onload, onerror, or other JavaScript event handlers in uploaded file storage
• Unusual SVG file uploads with embedded javascript: URI schemes
• Web server logs showing requests to file preview endpoints followed by suspicious outbound connections
• User reports of unexpected browser behavior when viewing file previews

Detection Strategies

• Implement file content inspection rules to detect SVG files containing JavaScript elements such as <script>, onclick, onload, onerror, or javascript: URIs
• Monitor web application firewall (WAF) logs for SVG uploads with suspicious XML content patterns
• Review access logs for the /api/file/upload-chunk endpoint to identify unusual upload patterns or sources

Monitoring Recommendations

• Enable content security policy (CSP) violation reporting to detect when inline scripts attempt to execute
• Configure SIEM alerts for any SVG file uploads that trigger content filtering rules
• Monitor for unusual session activity following file preview access, which may indicate session hijacking attempts

How to Mitigate CVE-2026-35608

Immediate Actions Required

• Upgrade QuickDrop to version 1.5.3 or later immediately
• Review existing uploaded SVG files for malicious content and remove any suspicious files
• Implement Content Security Policy (CSP) headers to restrict inline script execution as a defense-in-depth measure
• Consider temporarily blocking SVG file uploads until the patch is applied

Patch Information

The vulnerability has been fixed in QuickDrop version 1.5.3. Organizations should upgrade to this version or later to remediate the vulnerability. The fix is available via the GitHub Release v1.5.3. For detailed technical information about the vulnerability, refer to the GitHub Security Advisory GHSA-f577-ffvv-w6rr.

Workarounds

• Block SVG file uploads at the application or WAF level until the patch can be applied
• Serve uploaded SVG files with the Content-Disposition: attachment header to force download instead of inline rendering
• Implement strict CSP headers that disable inline JavaScript execution: Content-Security-Policy: script-src 'self'
• Use SVG sanitization libraries to strip potentially malicious content from uploaded SVG files before storage

# Example: Configure web server to force SVG downloads (Apache)
<FilesMatch "\.svg$">
    Header set Content-Disposition "attachment"
    Header set X-Content-Type-Options "nosniff"
</FilesMatch>