CVE-2026-120514

Name of the Vulnerable Software and Affected Versions Zephyr Project Manager versions prior to 3.3.210

Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting. By injecting arbitrary web scripts via the zpm profile picture parameter, the payload is stored in the attacker's Zephyr profile. The script executes in an Administrator's browser session when the autocomplete mention lookup renders the avatar field. This process requires an action by an administrator to be triggered.

Recommendations Update to a version newer than 3.3.209. Avoid using the zpm profile picture parameter until the update is applied.