CVE-2026-48788

Name of the Vulnerable Software and Affected Versions Remark42 versions 1.6.0 through 1.15.0

Description Remark42 contains a Cross-Site Scripting (XSS) issue exploitable through content-type spoofing via the image proxy. The proxy fetches a remote URL and re-serves the response from its own origin. A discrepancy exists between the download phase, which validates the resource as an image by only inspecting the Content-Type header, and the serving phase, which uses http.DetectContentType to sniff the actual bytes. An attacker can host a URL that advertises Content-Type: image/png but contains an HTML/JavaScript body. The proxy accepts the file as an image, but the browser renders it as HTML within the Remark42 origin. This allows the execution of authenticated same-origin API calls, access to the XSRF-TOKEN cookie to bypass CSRF protections, and the ability to perform actions as the victim, including administrative tasks if the victim has admin privileges. Exploitation requires no account on the target instance; the attacker only needs to deliver the proxy link to a victim. The vulnerable endpoint is /api/v1/img using the src parameter.

Recommendations Update Remark42 to version 1.16.0. For operators using a CDN or edge cache, purge the /api/v1/img cache after updating to version 1.16.0.