CVE-2026-72583

Name of the Vulnerable Software and Affected Versions fastschema versions prior to 0.15.2

Description A stored cross-site scripting (XSS) issue exists where a low-privileged authenticated user can upload an SVG file containing malicious JavaScript. This occurs because the PutMultipart() function in pkg/rclonefs/base.go validates the Content-Type header provided by the client instead of inspecting the actual file content. An attacker can bypass the MIME type allow-list check by renaming a file to .jpg while specifying image/svg+xml as the header, allowing the storage of a script-bearing SVG in the web root.

Recommendations Update fastschema to version 0.15.2 or later.