CVE-2026-124491 SunEditor before 3.4.0 Stored XSS via FileUpload Plugin Filename

Medium 5.3 Published 8 Nov 2026 Updated 9 Nov 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-124491?

CVE-2026-124491 is a medium-severity vulnerability in JiHong88 suneditor, published on 8 Nov 2026.

Official description

SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the FileUpload plugin create() method that assigns server-returned file names to innerHTML without escaping. Attackers can upload files with HTML-laden names that bypass html.clean() and execute JavaScript in victims' browsers when content or gallery items load, enabling session theft.

Weakness: CWE-79

Which versions are affected by CVE-2026-124491?

How do I fix CVE-2026-124491?

No fix has been published for CVE-2026-124491 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-124491 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-124491 exists.

Sources

Also known as GHSA-2w4v-r3v4-f5h4, GHSA-m98v-phcq-735w.