CVE-2026-124435

Name of the Vulnerable Software and Affected Versions OpenRemote versions prior to 1.32.2

Description Authenticated users with write:admin permissions can perform a stored cross-site scripting attack by uploading HTML or SVG files containing JavaScript through the Manager configuration file upload endpoint. An attacker can then direct victims to the unauthenticated image retrieval endpoint, which serves these files as text/html or image/svg+xml, resulting in the execution of scripts within the application origin.

Recommendations Update to version 1.32.2 or later.