CVE-2026-23499: Saleor vulnerable to stored XSS via Unrestricted File Upload

Overview

Affected Products

• saleor/saleor

Details

Saleor allowed authenticated staff users or Apps to upload arbitrary files, including malicious HTML and SVG files containing Javascript. Depending on the deployment strategy, these files may be served from the same domain as the dashboard without any restrictions leading to the execution of malicious scripts in the context of the user's browser.

Impact

Malicious staff members could craft script injections to target other staff members, possibly stealing their access and/or refresh tokens.

Am I Impacted?

You are impacted if:

• You host the media files inside the same domain as the dashboard, e.g., dashboard is at example.com/dashboard/ and media are under example.com/media/ - you are not impact if media files are hosted in a different domain, e.g., media.example.com.
• You do not return a Content-Disposition: attachment header for the media files.

Saleor Cloud users are not impacted.

Detection & Mitigations

This issue has been patched in versions: 3.22.27, 3.21.43, and 3.20.108.

IMPORTANT: if you believe you are impacted, or if you are unsure or want to verify, you should run the following command:

$ ./manage.py remove_invalid_files

This scans all uploaded files (in the media storage, e.g., the filesystem, a S3 bucket, etc.). You should look for unexpected files, if you see differences, then either:

• Change the configuration so that Saleor allows the file (see the documentation for file uploads)
• Delete the file manually or automatically (./manage.py remove_invalid_files --apply)

Workarounds

We strongly recommend upgrading to the latest versions, in case of inability to upgrade straight away, a possible workarounds are:

• Configure the servers hosting the media files (e.g., CDN or reverse proxy) to return the Content-Disposition: attachment header. This instructs browsers to download the file instead of rendering them in the browser.
• Prevent the servers from returning HTML and SVG files.
• Set-up a Content-Security-Policy for media files, such as Content-Security-Policy: default-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'none';

References

• Issue introduced by https://github.com/saleor/saleor/commit/9110eba68c3f73afa1f72b45bd9b1394c752d335
• Documentation: https://docs.saleor.io/security/#restricted-file-uploads
• main patch: https://github.com/saleor/saleor/commit/b3cb27b3fe96dae3c879063e56d32a9398eabd24
• 3.22: https://github.com/saleor/saleor/commit/ac6936a336289c77398ef600cad3498ad4ba261c
• 3.21: https://github.com/saleor/saleor/commit/7d33efc7a06252320cd51cbb20c2e308aed2fd10
• 3.20: https://github.com/saleor/saleor/commit/77f7927a0db9a216440df92c51012136f13e1d99

Acknowledgements

This vulnerability was reported by Łukasz Rybak.

References

• https://github.com/saleor/saleor/security/advisories/GHSA-666h-2p49-pg95
• https://github.com/saleor/saleor/commit/77f7927a0db9a216440df92c51012136f13e1d99
• https://github.com/saleor/saleor/commit/7d33efc7a06252320cd51cbb20c2e308aed2fd10
• https://github.com/saleor/saleor/commit/9110eba68c3f73afa1f72b45bd9b1394c752d335
• https://github.com/saleor/saleor/commit/ac6936a336289c77398ef600cad3498ad4ba261c
• https://github.com/saleor/saleor/commit/b3cb27b3fe96dae3c879063e56d32a9398eabd24
• https://docs.saleor.io/security/#restricted-file-uploads

Disclaimer

This CVE was responsibly disclosed following coordinated vulnerability disclosure practices. The information provided here is for educational and defensive purposes only.