Vulnerability · Published May 11, 2026 · Assigned by Sonatype

CVE-2026-7308Nexus Repository 3 - Stored Cross-Site Scripting (XSS) via HTML Browse Page

Medium 5.1

In plain English

A medium-severity cross-site scripting in Nexus Repository from Sonatype. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).

Severity (CVSS 4.0)5.1Medium

Exploit odds (30 days)0.3%top 82.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An authenticated user with upload permission to a hosted repository can store content that causes arbitrary JavaScript to execute in the browser of any user who browses that repository directory via the HTML index page in Sonatype Nexus Repository versions 3.6.0 through versions before 3.92.0. This could allow the attacker to perform actions in the context of the victim's session.

Affected products (as reported)

Vendor	Product	Versions
Sonatype	Nexus Repository	3.6.0 – before 3.92.0

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

In plain English

Official description

Affected products (as reported)

References