Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A flaw was found in Quay. The filedrop endpoint accepts any mime type without validation, allowing an authenticated user with repository write access to upload a malicious SVG file containing JavaScript. The file is stored and served inline through the CDN, enabling stored cross-site scripting when a victim visits the archive URL.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-11569 Stored Cross-Site Scripting in Quay via Unvalidated SVG File Upload https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-11569
Post summary
A stored XSS vulnerability (CVE-2026-11569) is disclosed for Quay, arising from unvalidated SVG file uploads, with no PoC, patch, or active exploitation mentioned.
CVE-2026-11569 A flaw was found in Quay. The filedrop endpoint accepts any mime type without validation, allowing an authenticated user with repository write access to upload a mali… https://www.cve.org/CVERecord?id=CVE-2026-11569
Post summary
A flaw in Quay’s filedrop endpoint allows authenticated users with repository write access to upload malicious files because of missing MIME type validation.