CVE-2026-48788
Publiée le 2026-06-17 · Dernière modification le 2026-10-25
Les versions 1.6.0 à 1.15.0 des moteurs de commentaires Remark42 sont vulnérables à une attaque de type cross-site scripting (XSS) via le proxy d'images. Un attaquant non authentifié peut inciter un visiteur à cliquer sur un lien malveillant, lui permettant ainsi d'exécuter du code JavaScript arbitraire dans le navigateur de la victime sous le domaine Remark42. Cela ne nécessite aucun privilège particulier ni d'accès au serveur, seulement l'interaction d'un utilisateur avec un lien fourni par l'attaquant.
DÉTAIL DU VECTEUR CVSS
RÉFÉRENCES
Description officielle du NVD (en anglais)
Remark42 is a self-hosted comment engine for blogs, articles, or any other place where readers can add comments. Versions 1.6.0 through 1.15.0 contain a Cross-Site Scripting (XSS) vulnerability exploitable through content-type spoofing. The Remark42 image proxy fetches an arbitrary remote URL and re-serves the response from Remark42's own origin. During the download phase, the proxy determines whether the resource is an image by inspecting only the Content-Type header advertised by the remote server, never examining the actual bytes; during the serving phase, it instead derives the response Content-Type by sniffing those bytes with http.DetectContentType. An attacker can exploit this inconsistency by hosting a URL that advertises Content-Type: image/png while returning an HTML/JavaScript body: the download check accepts it as an image, the serving path sniffs the body and emits Content-Type: text/html, and the browser renders the attacker-controlled HTML/JavaScript as a document within Remark42's origin. Exploitation requires no Remark42 account on the target instance; the attacker only needs to host the malicious upstream URL and deliver the proxy link to a victim by any means, such as email, direct message, or a link on another website. This issue has been fixed in version 1.16.0.