CVE-2026-96535 | BDVDB-2026-387921 Detail

Description#

Cross-Site Scripting on the YouMind portal, specifically in the avatar update endpoint, when setting a profile picture via an arbitrary URL. This occurs due to a lack of sanitisation and validation of SVG content when setting an SVG image containing embedded JavaScript code as the avatar. The file is served by the CDN with Content-Type: image/svg+xml and, when navigating directly to that URL, the script executes within the context of the CDN’s domain.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-10-13Record published in the CVE List.
2. Version 22026-10-16Most recent update recorded in the CVE List.