CVE-2023-26961: Alteryx Server 2022.1.1.42590 does not employ file type verification for uploaded files.

Security readout for executives and security teams

CVE-2023-26961 affects Alteryx Server 2022.1.1.42590. The server reportedly fails to verify uploaded file types, allowing arbitrary file uploads through a media API request. One stated impact is stored cross-site scripting if JavaScript content is uploaded and later rendered. Public sources do not provide a CVSS score, vendor advisory details, or confirmed active exploitation. Organizations running Alteryx Server 2022.1.1.42590 with the Gallery media upload API reachable may be exposed. Exposure depends on who can access the endpoint and whether uploaded content is later viewed or executed in a browser context. Treat as a prioritized review item for Alteryx environments, especially internet-facing or broadly accessible Gallery deployments. Business risk is mainly stored browser-based compromise and untrusted file storage. Urgency is limited by incomplete public severity and exploitation evidence. Mitigation focus: Check Alteryx vendor guidance for affected versions and fixes.; Upgrade or patch if Alteryx identifies a corrected release.; Restrict Gallery API access to trusted users and networks..

Prepared

Jul 5, 2026, 08:20 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.