Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-48788— Remark42: Cross-Site Scripting (XSS) on /api/v1/img via content-type spoofing

Quick assessment

Affected
umputun remark42
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

umputun remark42是umputun个人开发者的一个轻量级评论系统。 umputun remark42 1.6.0版本至1.15.0版本存在处理逻辑错误漏洞，该漏洞源于内容类型欺骗，可能导致跨站脚本攻击。

AI Predicted 6.1 Difficulty: Easy EPSS 0.31% · P24

Affected Version Matrix 1

VendorProduct Version RangeStatus
umputun remark42 >= 1.6.0, < 1.16.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-48788

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Remark42: Cross-Site Scripting (XSS) on /api/v1/img via content-type spoofing
Source: CVE Program / CVE List V5
Vulnerability Description
Remark42 is a self-hosted comment engine for blogs, articles, or any other place where readers can add comments. Versions 1.6.0 through 1.15.0 contain a Cross-Site Scripting (XSS) vulnerability exploitable through content-type spoofing. The Remark42 image proxy fetches an arbitrary remote URL and re-serves the response from Remark42's own origin. During the download phase, the proxy determines whether the resource is an image by inspecting only the Content-Type header advertised by the remote server, never examining the actual bytes; during the serving phase, it instead derives the response Content-Type by sniffing those bytes with http.DetectContentType. An attacker can exploit this inconsistency by hosting a URL that advertises Content-Type: image/png while returning an HTML/JavaScript body: the download check accepts it as an image, the serving path sniffs the body and emits Content-Type: text/html, and the browser renders the attacker-controlled HTML/JavaScript as a document within Remark42's origin. Exploitation requires no Remark42 account on the target instance; the attacker only needs to host the malicious upstream URL and deliver the proxy link to a victim by any means, such as email, direct message, or a link on another website. This issue has been fixed in version 1.16.0.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
umputun remark42 处理逻辑错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
umputun remark42是umputun个人开发者的一个轻量级评论系统。 umputun remark42 1.6.0版本至1.15.0版本存在处理逻辑错误漏洞，该漏洞源于内容类型欺骗，可能导致跨站脚本攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
umputun remark42 >= 1.6.0, < 1.16.0 -

II. Public POCs for CVE-2026-48788

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-48788

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-48788 (1)

Vendor Advisories for CVE-2026-48788 (1)

Vendor Pages for CVE-2026-48788 (1)

IV. Related Vulnerabilities

Same product: remark42
Same vendor: umputun
Same weakness: CWE-79