CVE-2026-18682

Name of the Vulnerable Software and Affected Versions OpenAkita versions prior to 1.27.13

Description A flaw in the File Upload API component allows remote attackers to perform cross-site scripting (XSS), which is a technique used to inject malicious scripts into web pages viewed by other users. The issue exists within the /api/upload endpoint and is triggered by the manipulation of the File argument. This attack is characterized by high complexity and difficult exploitability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict access to the /api/upload endpoint to minimize the risk of exploitation.