CVE-2026-75529

Name of the Vulnerable Software and Affected Versions Pandora (affected versions not specified)

Description A stored cross-site scripting issue exists in the PDF download functionality. The endpoint '/task-download//.../pdf' uses content-based detection to verify files as PDFs but fails to explicitly specify the MIME type or force the file to be downloaded as an attachment when using the send file() function. An attacker can upload a polyglot file—a file that is valid in two different formats—which Pandora recognizes as a PDF, but whose filename triggers the server to return a different active MIME type. This allows the browser to interpret the file as HTML or another executable web format, executing attacker-controlled scripts within the application's security context and potentially compromising the victim's session data.

Recommendations Update the software to the patched version that explicitly returns PDF downloads with Content-Type: application/pdf, forces Content-Disposition: attachment, and assigns a trusted .pdf filename based on the task UUID.