CVE-2026-33653 Uploady Vulnerable to Stored Cross-Site Scripting (XSS)
Attackers can inject malicious scripts via filenames that execute in victims' browsers when viewing file lists, requiring an upgrade to fix.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-33653?
CVE-2026-33653 is a medium-severity cross-site scripting vulnerability in farisc0de Uploady, published on 26 Mar 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Ulloady is a file uploader script with multi-file upload support. A Stored Cross-Site Scripting (XSS) vulnerability exists in versions prior to 3.1.2 due to improper sanitization of filenames during the file upload process. An attacker can upload a file with a malicious filename containing JavaScript code, which is later rendered in the application without proper escaping. When the filename is displayed in the file list or file details page, the malicious script executes in the browser of any user who views the page. Version 3.1.2 fixes the issue.
Weakness: CWE-79
Which versions are affected by CVE-2026-33653?
It affects 1 product.
Products include Farisc0de Uploady.
How do I fix CVE-2026-33653?
No fix has been published for CVE-2026-33653 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-33653 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-33653 exists.
Sources
Also known as GHSA-2834-m7xm-fqr5.