CVE-2026-75529— Stored Cross-Site Scripting via MIME-Type Confusion in PDF Downloads of Pandora

Stored Cross-Site Scripting via MIME-Type Confusion in PDF Downloads of Pandora

Pandora is affected by a stored cross-site scripting vulnerability in the PDF download functionality. The /task-download/<task_id>/.../pdf endpoint verifies that the submitted file is a PDF using Pandora's content-based file-type detection, but previously returned the file using send_file(task.file.path) without explicitly specifying the MIME type or forcing it to be downloaded as an attachment. Because Flask determines the response MIME type from the filename when a path is supplied, an attacker could submit a file whose content is recognized by Pandora as a PDF while its filename or extension causes the download endpoint to return it with a different, potentially active MIME type. A specially crafted PDF/polyglot file could therefore be served inline and interpreted by a victim's browser as HTML or another executable web format. If a victim with access to the submitted analysis follows the PDF download link, attacker-controlled script could execute in the security context of the Pandora application, potentially allowing access to application data or actions using the victim's session. The patch prevents the issue by explicitly returning PDF downloads with Content-Type: application/pdf, forcing Content-Disposition: attachment, and assigning a trusted .pdf filename based on the task UUID.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Pandora analysis Pandora 跨站脚本漏洞

Pandora analysis Pandora是Pandora analysis组织开源的一个分析框架，用于发现文件是否可疑，并方便地显示结果。 Pandora analysis Pandora 1.12.5及之前版本存在跨站脚本漏洞，该漏洞源于PDF下载功能对文件类型验证不严，未明确指定MIME类型或强制作为附件下载，导致特制PDF/polyglot文件可能被浏览器解析为HTML等可执行Web格式，造成存储型跨站脚本攻击，攻击者可在受害者浏览器安全上下文中执行脚本，可能访问应用数据或利用受害者会话执行

N/A

N/A