CVE-2026-11569 – Quay: quay: stored xss via filedrop svg upload

CVE ID :CVE-2026-11569

Published : June 8, 2026, 12:16 p.m. | 16 minutes ago

Description :A flaw was found in Quay. The filedrop endpoint accepts any mime type without validation, allowing an authenticated user with repository write access to upload a malicious SVG file containing JavaScript. The file is stored and served inline through the CDN, enabling stored cross-site scripting when a victim visits the archive URL.

Severity: 5.4 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…