CVE-2026-90453: File Upload CSRF Redirect Vulnerability

CVE-2026-90453 Overview

CVE-2026-90453 is an open redirect vulnerability [CWE-601] in a file-upload handler that trusts the HTTP Referer header to determine the post-upload redirect destination. The handler forwards the authenticated user's browser to whatever URL appears in that header, without validating it against the application's own origin. An authenticated attacker can craft a request that sends another user's browser to an arbitrary external destination after the upload completes. The issue is documented in CISA ICS Advisory ICSA-26-254-01.

Critical Impact
Authenticated attackers can redirect victim browsers to attacker-controlled URLs, enabling phishing, credential harvesting, and malware delivery under the trust context of the legitimate application.

Affected Products

Product identified in CISA ICS Advisory ICSA-26-254-01
Specific vendor and product entries were not published in the NVD record
Refer to the linked CISA advisory for the authoritative affected-product list

Discovery Timeline

2026-09-11 - CVE-2026-90453 published to the National Vulnerability Database
2026-09-18 - Last updated in the NVD database

Technical Details for CVE-2026-90453

Vulnerability Analysis

The vulnerability is a classic URL redirection to untrusted site issue [CWE-601]. The file-upload endpoint reads the Referer header from the incoming HTTP request and issues an HTTP redirect (typically a 302 response with a Location header) pointing at the value it read. Because the Referer header is fully controlled by the requester, any URL can be supplied, including URLs pointing at attacker infrastructure on unrelated domains.

The handler performs no allowlist check, no same-origin comparison, and no scheme restriction on the value. A user who clicks a link, submits a form, or is otherwise induced to send an upload request with a crafted Referer header will land on the attacker's chosen destination immediately after the upload succeeds. Because the redirect originates from the trusted application, the target URL appears to the victim as a legitimate navigation flow.

Root Cause

The root cause is missing input validation on a security-sensitive HTTP header. The application treats the Referer header as a trusted return address for post-action navigation. HTTP headers submitted by clients are attacker-controllable, and using them for authoritative routing decisions without validation violates standard secure-design guidance for redirect handling.

Attack Vector

Exploitation requires network access to the application and valid low-privilege authentication. The attacker crafts a file-upload request that includes a Referer header pointing to an attacker-controlled URL, then induces a victim to trigger that request (for example, via a malicious link or embedded form). The victim's browser completes the upload and is redirected to the external destination. User interaction is required, and the impact is limited to redirection rather than direct data compromise on the application itself. No verified public exploit code is available for CVE-2026-90453 at the time of publication.

Detection Methods for CVE-2026-90453

Indicators of Compromise

HTTP 302 or 303 responses from the file-upload endpoint containing a Location header pointing to an external domain
Inbound upload requests where the Referer header does not match the application's own hostname or any expected internal referrer
User reports of unexpected navigation to unfamiliar sites immediately after uploading a file
Spikes in outbound clicks from application users to newly registered or low-reputation domains

Detection Strategies

Instrument the upload handler to log the raw Referer header alongside the redirect target it emits
Alert when the Location header issued by the upload endpoint contains a hostname outside the allowlist of trusted domains
Correlate authenticated session identifiers with anomalous redirect destinations to identify attacker-issued requests

Monitoring Recommendations

Route web server and application logs into a centralized analytics platform and retain full HTTP request and response header metadata
Monitor URL categorization feeds and DNS telemetry for outbound traffic to newly observed domains referenced in application redirects
Track failed phishing report submissions and help desk tickets that reference the affected application as the referring source

How to Mitigate CVE-2026-90453

Immediate Actions Required

Apply the vendor patch referenced in CISA ICS Advisory ICSA-26-254-01 as soon as it is available for your deployment
Audit the file-upload handler and remove any logic that treats the Referer header as a trusted destination for redirects
Notify authenticated users of the phishing risk and remind them to verify destination URLs after file uploads

Patch Information

Consult the vendor advisory linked from CISA ICS Advisory ICSA-26-254-01 for the fixed version and installation guidance. The NVD record for CVE-2026-90453 does not enumerate specific fixed builds; use the CSAF document referenced above as the authoritative source.

Workarounds

Replace the Referer-driven redirect with a server-side allowlist of permitted return paths, all of which are relative to the application's own origin
If a redirect target must be accepted from the request, validate the parsed URL's scheme and hostname against the application's canonical origin before issuing the response
Deploy a web application firewall rule that strips or normalizes the Referer header on requests to the upload endpoint
Configure a strict Content Security Policy and use interstitial warning pages for any outbound navigation the application must legitimately perform

bash

# Example WAF rule concept: block upload requests whose Referer points off-origin
# (adapt to your WAF syntax; this is illustrative)
SecRule REQUEST_URI "@beginsWith /upload" \
  "chain,phase:1,deny,status:400,id:1090453,msg:'Off-origin Referer on upload'"
  SecRule REQUEST_HEADERS:Referer "!@beginsWith https://app.example.com/" "t:none"