CVE-2026-15371
Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the cell value and forms a URL which can be clicked in the GUI.The code does not limit the schemes allowed in this URL , allowing an attacker to specify a JavaScript scheme exposing the user to XSS.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.1
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N
- EPSS probability
- 0.21%
- CWE
- CWE-177
- Published
- 2026-08-18
- Last modified
- 2026-08-19
Affected products
- Rapid7 Velociraptor
Weakness type
Related vulnerabilities
- CVE-2026-76172 — fast-uri vulnerable to host confusion via percent-encoded scheme normalization
- CVE-2026-67448 — Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689)
- CVE-2026-59083 — Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass
- CVE-2026-41041 — Apache Gravitino: URL path injection via unencoded user-supplied identifiers in MCP REST client f-string URL construction, enabling path traversal to unintended API endpoints.
- CVE-2026-6414 — @fastify/static vulnerable to route guard bypass via encoded path separators
- CVE-2026-29045 — Hono: Arbitrary file access via serveStatic vulnerability
- CVE-2026-22037 — @fastify/express vulnerable to Improper Handling of URL Encoding (Hex Encoding)
- CVE-2026-22031 — Fastify Middie Middleware Path Bypass