CVE-2026-30578

Name of the Vulnerable Software and Affected Versions File Thinghie version 2.5.7

Description File Thinghie version 2.5.7 is susceptible to Cross Site Scripting (XSS). A malicious user can exploit this to execute arbitrary JavaScript code by manipulating the dir parameter within a GET request. The vulnerable API endpoint is accessed via a GET request. The dir parameter is the vulnerable variable.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, sanitize the dir parameter to prevent the injection of malicious scripts.