CVE-2026-72594highCWE-79

CVE-2026-72594: falha de alta gravidade em lobehub lobe-chat

lobehub lobe-chat - Stored Cross-Site Scripting via Unrestricted SVG Avatar Upload

Publicada em

Seguir esta CVE+ Monitorar lobe-chat

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.6epss 0.3%
A stored cross-site scripting (XSS) vulnerability in lobehub/lobe-chat through v2.2.13 allows a low-privileged authenticated user to inject arbitrary JavaScript into the application by uploading a crafted SVG file as a user avatar.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
Produtos afetados
lobehub · lobe-chat
CVEs relacionadas — lobehub lobe-chat

No mesmo produto, das mais perigosas para as menos.

CVE-2024-32964CRITICALlobe-chat `/api/proxy` endpoint Server-Side Request Forgery vulnerabilityEPSS 53.0%CVE-2024-32965HIGHssrf vulnerability in lobe-chatEPSS 26.1%CVE-2024-47066CRITICALLobe Chat has insufficient fix for GHSA-mxhq-xw3g-rphc (CVE-2024-32964)EPSS 11.9%CVE-2024-37895MEDIUMAPI Key Leak in lobe-chatEPSS 0.5%CVE-2024-24566MEDIUMLobe Chat unauthorized access to pluginsEPSS 0.5%CVE-2025-59417MEDIUMLobe Chat Desktop Vulnerable to Remote Code Execution via XSS in Chat MessagesEPSS 0.4%