CVE-2026-119764highCWE-79

CVE-2026-119764: falha de alta gravidade em its-a-feature Mythic

Mythic 3.2.16 through 3.4.0.61 Stored XSS via Agent-Downloaded File Preview

Publicada em

Seguir esta CVE+ Monitorar Mythic

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.4epss 0.3%
Mythic 3.2.16 through 3.4.0.61 contains a stored cross-site scripting vulnerability that allows attackers controlling target endpoint files to run JavaScript in the Mythic UI origin by planting HTML in .pdf-named files. When an operator downloads the file and clicks Preview Media, content-sniffed HTML from /direct/view renders same-origin, stealing localStorage JWTs for full GraphQL and REST access.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
its-a-feature · Mythic
CVEs relacionadas — its-a-feature Mythic

No mesmo produto, das mais perigosas para as menos.

CVE-2026-57953MEDIUMMythic < 3.4.0.60 - Unauthorized Automation Workflow Modification via eventing_import_automatic_webhook EndpointEPSS 0.4%CVE-2026-57951HIGHMythic < 3.4.0.60 - Broken Permission Filter in payload_build_step TableEPSS 0.4%CVE-2026-57952MEDIUMMythic < 3.4.0.60 - Unauthorized C2 Profile Configuration Access via Unverified Payload UUIDEPSS 0.3%