Vulnerability · Published Feb 20, 2026 · Assigned by GitHub_M

CVE-2026-26993Flare has XSS vulnerability in Raw File Preview

Medium 4.6

In plain English

A medium-severity cross-site scripting in Flare from FlintSH. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).

Severity (CVSS 3.1)4.6Medium

Exploit odds (30 days)0.3%top 74.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Flare is a Next.js-based, self-hostable file sharing platform that integrates with screenshot tools. Versions 1.7.0 and below allow users to upload files without proper content validation or sanitization. By embedding malicious JavaScript within an SVG (or other active content formats such as HTML or XML), an attacker can achieve script execution in the context of the application's origin when a victim views the file in “raw” mode. This results in a stored Cross-Site Scripting (XSS) vulnerability that can be exploited to exfiltrate user data. This issue has been fixed in version 1.7.1.

Affected products (as reported)

Vendor	Product	Versions
FlintSH	Flare	1.7.1

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

References

https://github.com/FlintSH/Flare/security/advisories/GHSA-q8fp-w6m5-4gjm x_refsource_CONFIRM
https://github.com/FlintSH/Flare/commit/7763d7b954799552f287ab9260bb1353f8880163 x_refsource_MISC
https://github.com/FlintSH/Flare/releases/tag/v1.7.1 x_refsource_MISC