lindhunt/cve-2026-18741Proof-of-concept for CVE-2026-18741, a stored XSS vulnerability in Worksuite SaaS Asset Management, demonstrating attacker-controlled JavaScript execution and providing remediation guidance.
CVE-2026-18741 is a Stored XSS vulnerability affecting Worksuite SaaS versions prior to 6.0.14.
The issue is located in the Asset Management module.
User-controlled input can be stored through fields such as:
The stored input is later rendered when the affected asset is viewed, allowing attacker-controlled JavaScript to execute in the browser context of the user viewing the asset.
Worksuite SaaS < 6.0.14
Fixed
Worksuite SaaS >= 6.0.14
[ Attacker-controlled input ]
A successful exploitation may allow JavaScript to execute in the security context of the affected application.
Depending on the victim's privileges and application configuration, possible consequences include:
The actual impact depends on the application's configuration and the privileges of the affected user.
The PoC demonstrates the vulnerability through the Asset Management functionality.
The complete demonstration is available in the video below.
Video: YouTube — CVE-2026-18741 PoC
| Field | Value |
|---|---|
| CVE | CVE-2026-18741 |
| Type | Stored Cross-Site Scripting |
| CWE | CWE-79 |
| CVSS v4.0 | 4.6 — Medium |
| Affected Component | Asset Management |
| Affected Versions | < 6.0.14 |
| Fixed Version | 6.0.14+ |
Upgrade Worksuite SaaS to version 6.0.14 or later.
Applications should also ensure that untrusted input is properly validated and contextually encoded before being rendered in HTML.
This repository is intended for educational purposes and authorized security research only.
The PoC was demonstrated in a controlled environment.
Do not use this PoC against systems without explicit authorization.
The author is not responsible for misuse of the information contained in this repository.
CVE-2026-18741 · Security Research · Stored XSS