# CVE-2026-124435: OpenRemote stored cross-site scripting in Manager configuration image upload

Source: https://junglewise.ai/threats/cve-2026-124435-openremote-before-1-32-2-contains-a-stored-cross-site-scripting  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-08. Updated: 2026-11-08  
License: CC BY 4.0 with a link back

CVE-2026-124435 · Severity: medium · CVSS 4.8 · Published 2026-11-08

OpenRemote is a configuration and deployment platform for IoT and automation systems. The platform's Manager component allows authenticated administrators to upload image files, but fails to validate file contents, permitting upload of HTML or SVG files with malicious JavaScript. An attacker can trick users into opening these uploaded files through an unauthenticated endpoint, causing the JavaScript to execute in the browser and potentially compromise user sessions or steal sensitive data.

Technologies: [OpenRemote Core](https://junglewise.ai/threats/technologies/openremote-core). Vendors: [OpenRemote](https://junglewise.ai/threats/vendors/openremote).

## Quick answers

**Is CVE-2026-124435 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-124435 being exploited in the wild.

**How severe is CVE-2026-124435?** Medium severity, with a CVSS score of 4.8, published 8 November 2026.

**Which products and versions are affected?** OpenRemote Core before 1.32.2.

**Is there a fix for CVE-2026-124435?** Yes: fixed in 1.32.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-124435 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-124435?** Check whether you run OpenRemote Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.32.2

## Technical details

The vulnerability is a stored cross-site scripting flaw in the Manager configuration image upload endpoint (POST /api/{realm}/configuration/manager/file). Authenticated users with write:admin permissions can upload HTML or SVG files containing JavaScript; the saveManagerConfigImage() method writes Base64-decoded content without validating file type. An unauthenticated GET endpoint serves these files with MIME types determined by file extension (text/html for .html, image/svg+xml for .svg), allowing JavaScript execution in the browser within the application's origin.

## Affected products

- OpenRemote core before 1.32.2

## Timeline

- 2026-10-23: disclosed
- 2026-11-08: advisory

## References

- [https://github.com/openremote/core/security/advisories/GHSA-vgp4-96p8-3w8v](https://github.com/openremote/core/security/advisories/GHSA-vgp4-96p8-3w8v)
- [https://www.vulncheck.com/advisories/openremote-before-1.32.2-stored-xss-via-manager-configuration-image-upload](https://www.vulncheck.com/advisories/openremote-before-1.32.2-stored-xss-via-manager-configuration-image-upload)

## Related threats

- [OpenRemote core authorization bypass via reversible asset ID mapping](https://junglewise.ai/threats/cve-2026-116186-openremote-core-openremote-manager-before-1-31-0-does-not)
- [OpenRemote core authorization bypass in gateway tunnel endpoint](https://junglewise.ai/threats/cve-2026-116185-openremote-core-before-1-31-0-contains-an-authorization-bypass)