Security readout for executives and security teams
Plain-English summary
CVE-2026-23499 affects self-hosted Saleor deployments where uploaded media can be rendered from the same domain as the staff dashboard. An authenticated staff user or App could upload malicious HTML or SVG that runs JavaScript in another staff member’s browser, potentially exposing access or refresh tokens. Saleor Cloud is reported as not impacted.
Executive priority
Prioritize remediation for self-hosted Saleor environments with staff dashboards and media on the same domain. The issue can affect privileged staff sessions, but available sources indicate patches and configuration workarounds exist. Treat as high priority, especially for internet-facing commerce administration environments.
Technical view
Saleor versions before 3.20.108, 3.21.43, and 3.22.27 allowed authenticated staff users or Apps to upload arbitrary files. If media is served same-origin with the dashboard and without protective headers, stored XSS can execute in a victim staff browser. The CVSS v4.0 score is 8.5, with low attack complexity and required user interaction.
Likely exposure
Exposure is most likely in self-hosted Saleor 3.x environments where media files share the dashboard domain, such as /dashboard and /media on one host. Risk is lower when media is served from a separate domain. Saleor Cloud users are stated not to be impacted.
Exploitation context
Sources do not report active exploitation, and the CVE is not marked KEV. Abuse requires authenticated staff or App upload capability and a victim staff user opening or rendering the uploaded content. The main business risk is compromise of staff session tokens and unauthorized administrative activity.
Researcher notes
This is a stored XSS caused by unrestricted file upload behavior and unsafe media serving assumptions. The source states impact depends on deployment strategy and response headers. Evidence supports authenticated attacker requirements, user interaction, and no impact for Saleor Cloud. No public source in the bundle confirms exploitation in the wild.
Mitigation direction
- Upgrade Saleor to 3.20.108, 3.21.43, 3.22.27, or later as appropriate.
- Return Content-Disposition: attachment for media files.
- Prevent media servers from returning HTML and SVG files.
- Apply a restrictive Content-Security-Policy to media file responses.
- Prefer serving media from a separate domain from the dashboard.
- Review Saleor vendor guidance for branch-specific upgrade and configuration details.
Validation and detection
- Identify all self-hosted Saleor deployments and their exact versions.
- Confirm whether the deployment is Saleor Cloud or self-managed.
- Check whether dashboard and media are served from the same domain.
- Verify media responses include Content-Disposition: attachment.
- Verify HTML and SVG media are blocked or forced to download.
- Confirm a restrictive CSP is present on media responses.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-434: File access and web shell behavior lookup
File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupFile access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-23499 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.5 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
8.5HighVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/saleor/saleor/security/advisories/GHSA-666h-2p49-pg95CVE reference · x_refsource_CONFIRM
- https://github.com/saleor/saleor/commit/77f7927a0db9a216440df92c51012136f13e1d99CVE reference · x_refsource_MISC
- https://github.com/saleor/saleor/commit/7d33efc7a06252320cd51cbb20c2e308aed2fd10CVE reference · x_refsource_MISC
- https://github.com/saleor/saleor/commit/9110eba68c3f73afa1f72b45bd9b1394c752d335CVE reference · x_refsource_MISC
- https://github.com/saleor/saleor/commit/ac6936a336289c77398ef600cad3498ad4ba261cCVE reference · x_refsource_MISC
- https://github.com/saleor/saleor/commit/b3cb27b3fe96dae3c879063e56d32a9398eabd24CVE reference · x_refsource_MISC
- https://docs.saleor.io/security/#restricted-file-uploadsCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.