PT-2026-145471
CVE-2026-126814
·
Published
2026-11-11
·
Updated
2026-11-11
Description by
CVSS 3.1
3.5
LowMetricsAV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
blueprintUE Self-Hosted Edition before 4.3.6 contains an iframe injection vulnerability that allows authenticated users to embed arbitrary third-party content by abusing the PeerTube video URL matcher in BlueprintService::findVideoProvider(). Attackers can set a blueprint video URL on an attacker-controlled host, which site.js loads in an unsandboxed iframe after consent, framing fake login forms or malware downloads.
Found an issue in the description? Have something to add? Feel free to write us 👾