Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
QuickDrop is an easy-to-use file sharing application. Prior to 1.5.3, a stored XSS vulnerability exists in the file preview endpoint. The application allows SVG files to be uploaded via the /api/file/upload-chunk endpoint. An attacker can upload a specially crafted SVG file containing a JavaScript payload. When any user views the file preview, the script executes in the context of the application's domain. This vulnerability is fixed in 1.5.3.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-35608 QuickDrop is an easy-to-use file sharing application. Prior to 1.5.3, a stored XSS vulnerability exists in the file preview endpoint. The application allows SVG files… https://www.cve.org/CVERecord?id=CVE-2026-35608
Post summary
The post announces a stored XSS flaw in QuickDrop’s file preview feature, providing technical details but no evidence of exploitation or mitigation.
Happy to share my latest security discovery! 🛡️ CVE-2026-35608 is officially live. It’s a Stored XSS via SVG upload that I found in the QuickDrop project. Seeing it being analyzed by the NIST NVD is a great milestone. Thanks to the maintainer for the quick fix! 🚀 #CVE #SecurityResearch #WebSecurity #GitHub
Post summary
The post announces the discovery and public release of CVE‑2026‑35608, a stored XSS flaw in the QuickDrop project, and notes that a patch has been issued.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | roastslav | quickdrop | - | - | - |