CVE-2026-9519: Pingvin Share XSS Vulnerability

CVE-2026-9519 Overview

CVE-2026-9519 is a reflected cross-site scripting (XSS) vulnerability affecting stonith404/pingvin-share versions up to and including 1.13.0. The flaw resides in the getServerSideProps function of frontend/src/pages/auth/signIn.tsx, part of the Sign-in Auto-Redirect component. An attacker can manipulate the redirect parameter to inject script content that executes in the victim's browser. The issue is classified under CWE-79 and is exploitable remotely over the network with user interaction. A public proof-of-concept has been released, and the vendor did not respond to disclosure attempts.

Critical Impact
Remote attackers can craft malicious sign-in URLs that execute arbitrary JavaScript in an authenticated user's browser session, enabling session theft, credential harvesting, or unauthorized actions on the Pingvin Share instance.

Affected Products

stonith404 pingvin-share — versions up to and including 1.13.0
Affected component: frontend/src/pages/auth/signIn.tsx
Affected function: getServerSideProps (Sign-in Auto-Redirect)

Discovery Timeline

2026-05-26 - CVE-2026-9519 published to the National Vulnerability Database
2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-9519

Vulnerability Analysis

The vulnerability is a reflected XSS in the Pingvin Share sign-in page. When a user accesses the sign-in route, the getServerSideProps function reads the redirect query parameter and propagates it into the rendered response without sufficient encoding or validation. An attacker who entices a victim to click a crafted link can cause the unsanitized redirect value to be reflected into the page or triggered as a navigation target.

Because Pingvin Share is a self-hosted file-sharing platform, successful exploitation runs in the security context of the application origin. This grants the attacker access to authenticated session data, share links, and any tokens stored in browser storage tied to that origin.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The redirect parameter accepted by getServerSideProps in signIn.tsx is not validated against an allowlist of safe relative paths and is not encoded before being used. The Sign-in Auto-Redirect logic trusts the supplied value, which allows attacker-controlled content to influence client-side execution.

Attack Vector

Exploitation requires the attacker to deliver a malicious URL to a victim, typically through phishing, chat, or an embedded link. When the victim opens the URL on a Pingvin Share instance, the manipulated redirect parameter triggers script execution in the user's browser. A public exploit is available, lowering the barrier for opportunistic attacks. Refer to the public proof-of-concept gist and the VulDB advisory for technical details on the payload construction.

Detection Methods for CVE-2026-9519

Indicators of Compromise

Inbound HTTP requests to /auth/signIn containing suspicious redirect query parameter values such as javascript:, data:, encoded <script> tags, or external URLs.
Web server or reverse proxy logs showing repeated requests with abnormally long or URL-encoded redirect values targeting the sign-in endpoint.
Browser console errors or unexpected outbound requests to unfamiliar domains originating from the Pingvin Share origin.

Detection Strategies

Implement web application firewall (WAF) rules to inspect the redirect parameter on /auth/signIn for script tokens, protocol handlers, and HTML entities.
Review application access logs for sign-in URLs containing reflected payloads and correlate with subsequent anomalous authenticated activity from the same client.
Deploy Content Security Policy (CSP) violation reporting to surface inline script execution attempts on the sign-in page.

Monitoring Recommendations

Alert on outbound browser requests from Pingvin Share origins to unrecognized domains shortly after a sign-in event.
Monitor for session token reuse from unexpected IP addresses or user agents following user clicks on externally sourced links.
Track high-volume failed or unusual sign-in attempts that include encoded characters in URL parameters.

How to Mitigate CVE-2026-9519

Immediate Actions Required

Restrict public exposure of the Pingvin Share sign-in page behind a VPN or authenticated reverse proxy until a fixed version is available.
Deploy a WAF rule that rejects or sanitizes any redirect parameter value not matching a strict allowlist of internal relative paths.
Notify users of the instance to avoid clicking sign-in links received from untrusted sources.

Patch Information

At the time of publication, no vendor-supplied patch has been referenced in the NVD data, and the vendor did not respond to disclosure. Operators should track the stonith404/pingvin-share repository for releases beyond 1.13.0 that address the getServerSideProps handling of the redirect parameter, and apply any subsequent security release immediately upon availability.

Workarounds

Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to the application origin only.
Configure the reverse proxy or load balancer to strip or validate the redirect query parameter on requests to /auth/signIn, rejecting values containing ://, javascript:, or non-alphanumeric path characters.
Require multi-factor authentication on the Pingvin Share instance to reduce the impact of session-token compromise resulting from successful XSS.

bash

# Example NGINX rule to block suspicious redirect parameter values on the sign-in endpoint
location = /auth/signIn {
    if ($arg_redirect ~* "(<|>|script|javascript:|data:|%3c|%3e)") {
        return 400;
    }
    proxy_pass http://pingvin_share_backend;
}