MEDIUM 5.1 NVD

CVE-2026-90453

A file-upload handler redirects the authenticated client's browser to a URL taken directly from that same request's Referer header, without validating it agains

A file-upload handler redirects the authenticated client's browser to a URL taken directly from that same request's Referer header, without validating it against the application's own origin. This allows an authenticated attacker to craft a request that causes another user's browser to be redirected to an arbitrary external destination after completing an upload.

References

https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-25

Published: 2026-09-11 · Source: NVD · Feed updated: 2026-09-11

This medium severity vulnerability with a CVSS score of 5.1 was published on 2026-09-11 via NVD.

vulnfeed aggregates 13138 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.