CVE-2026-107801

Name of the Vulnerable Software and Affected Versions Jivejdon versions prior to 5.1

Description Authenticated attackers can execute JavaScript on the application origin by uploading attachments with a manipulated Content-Type. By uploading a file declared as text/html, the UploadShowAction function serves the file inline, allowing the execution of scripts for any user who views the shared link. This is a stored cross-site scripting issue, where a malicious script is permanently stored on the server.

Recommendations Update Jivejdon to a version later than 5.0. Restrict the use of the UploadShowAction function to prevent the inline serving of user-uploaded files until the update is applied.