Executive brief
A security vulnerability has been identified in Red Hat Quay, a container image registry. An authorized user with permission to write to a repository can upload malicious files that execute scripts in the browsers of other users who view them. While this could be used to perform actions on behalf of a victim, sensitive session cookies are protected, which limits the risk of full account takeover.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the Red Hat Quay 'filedrop' endpoint (POST /api/v1/filedrop/). The endpoint fails to validate MIME types, allowing an authenticated attacker with repository write access to upload malicious SVG files containing embedded JavaScript. By referencing the resulting file_id in a build, the attacker can generate an archive URL served via the CDN. When a victim visits this URL, the browser renders the SVG inline and executes the script. While the script runs in the context of the Quay domain, the impact is mitigated by 'HttpOnly' and 'Secure' attributes on session cookies, preventing direct session hijacking.
Affected products
- Red Hat Quay
Timeline
- 2026-06-08: disclosed: Initial disclosure via Red Hat and NVD.