Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
HomeBox is a home inventory and organization system. Prior to 0.24.0-rc.1, a stored cross-site scripting (XSS) vulnerability exists in the item attachment upload functionality. The application does not properly validate or restrict uploaded file types, allowing an authenticated user to upload malicious HTML or SVG files containing executable JavaScript (also, potentially other formats that render scripts). Uploaded attachments are accessible via direct links. When a user accesses such a file in their browser, the embedded JavaScript executes in the context of the application's origin. This vulnerability is fixed in 0.24.0-rc.1.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-03 | 2 | Disclosure2 |
| 2026-03-04 | 1 | General1 |
CVE-2026-26272 Stored XSS Vulnerability in HomeBox Item Attachment Upload Functionality https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-26272
Post summary
The text announces a stored XSS vulnerability in HomeBox’s item attachment upload functionality, but provides no further details on exploitation, mitigation, or proof of concept.
CVE-2026-26272 HomeBox is a home inventory and organization system. Prior to 0.24.0-rc.1, a stored cross-site scripting (XSS) vulnerability exists in the item attachment upload func… https://www.cve.org/CVERecord?id=CVE-2026-26272
Post summary
The text announces a stored XSS vulnerability in HomeBox before version 0.24.0‑rc.1, providing technical details but no PoC, exploit, or patch information.
🚨*CVE* CVE-2026-26272 HomeBox is a home inventory and organization system. Prior to 0.24.0-rc.1, a stored cross-site scripting (XSS) vulnerability exists in the item attachment upload func… https://www.cve.org/CVERecord?id=CVE-2026-26272 ----- Traducción: CVE-2026-26272 Hom… http://infoflow.cloud`
Post summary
The post announces CVE‑2026‑26272, a stored XSS flaw in HomeBox before version 0.24.0‑rc.1, and links to the CVE record but provides no exploitation or mitigation details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | sysadminsmedia | homebox | - | - | - |