CVE-2026-52475: aiflowy XSS Vulnerability in Upload Module

CVE-2026-52475 Overview

CVE-2026-52475 is a Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting aiflowy versions 2.1.2 and earlier. The flaw resides in the UploadController.java file and allows a remote attacker to obtain sensitive information from users who interact with attacker-supplied content. Exploitation requires user interaction and can be triggered over the network without authentication. The vulnerability changes scope, meaning malicious script execution can affect resources beyond the initially vulnerable component.

Critical Impact
A remote attacker can inject malicious script content through the upload handler and steal session data or sensitive information from authenticated users.

Affected Products

aiflowy versions <= 2.1.2
UploadController.java component in aiflowy
Web applications embedding vulnerable aiflowy releases

Discovery Timeline

2026-07-21 - CVE-2026-52475 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-52475

Vulnerability Analysis

The vulnerability exists in the aiflowy UploadController.java file, which handles user-supplied file uploads. The controller fails to properly sanitize or encode content associated with uploaded files before returning it to the browser. When a victim views a page rendering the attacker-controlled data, the browser executes injected JavaScript in the context of the aiflowy application origin.

The CWE-79 classification places this flaw in the improper neutralization of input during web page generation category. The scope-changing nature of the flaw allows script execution to interact with additional application resources such as authenticated sessions, tokens, and user data reachable from the aiflowy origin.

Root Cause

The root cause is missing output encoding and insufficient input validation in UploadController.java. Filenames, metadata, or file contents supplied during upload are reflected back into HTML responses without HTML entity encoding or content-type enforcement. See the GitHub PoC Repository for technical details on the affected code path.

Attack Vector

The attack is delivered over the network and requires user interaction, typically by convincing a target to visit a link, open an uploaded file preview, or view an attacker-uploaded resource. Once the victim's browser renders the response, the payload executes and can read cookies, DOM data, or issue authenticated requests on behalf of the user.

Detection Methods for CVE-2026-52475

Indicators of Compromise

Uploaded files with names or metadata containing HTML tags such as <script>, <img onerror=>, or <svg onload=>.
HTTP responses from aiflowy endpoints returning user-supplied upload data without Content-Security-Policy headers.
Outbound requests from user browsers to unfamiliar domains shortly after accessing aiflowy upload pages.

Detection Strategies

Inspect web server and application logs for POST requests to upload endpoints containing script tags or JavaScript event handlers in filename or metadata fields.
Deploy Web Application Firewall (WAF) rules to flag reflected script patterns in responses served from UploadController routes.
Perform static analysis of aiflowy deployments to identify version 2.1.2 or earlier through pom.xml or build manifests.

Monitoring Recommendations

Monitor for anomalous session token usage originating from IP addresses different from the user's typical login location.
Alert on browser console errors and Content Security Policy violation reports referencing aiflowy origins.
Track upload endpoint traffic volume and payload entropy to detect scripted probing.

How to Mitigate CVE-2026-52475

Immediate Actions Required

Upgrade aiflowy to a version later than 2.1.2 once the maintainer publishes a fixed release.
Restrict access to upload functionality to authenticated and trusted users only.
Enforce a strict Content-Security-Policy header limiting inline script execution across aiflowy responses.

Patch Information

No vendor patch is referenced in the NVD entry at the time of publication. Consult the GitHub PoC Repository and the aiflowy project for updated release notes. Until an official fix is available, apply the compensating controls listed below.

Workarounds

Add server-side HTML entity encoding for all filename and metadata fields returned by UploadController.java.
Configure the upload endpoint to force Content-Disposition: attachment and a safe Content-Type such as application/octet-stream for user-supplied files.
Reject uploads whose filenames contain angle brackets, quotes, or JavaScript event handler substrings.
Deploy a WAF rule blocking reflected <script> and event-handler patterns on aiflowy routes.

bash

# Example nginx configuration to harden aiflowy upload responses
location /upload {
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "DENY" always;
    proxy_hide_header Content-Disposition;
    add_header Content-Disposition "attachment" always;
    proxy_pass http://aiflowy_backend;
}