Executive brief
Diskover Community, an open-source data management and file indexing platform, contains a security vulnerability that allows attackers to execute malicious scripts in a user's browser. By tricking an authenticated user into clicking a specially crafted link, an attacker can steal sensitive session cookies, potentially leading to full account takeover. This issue affects the community version of the software and can impact both standard users and administrators.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in diskover-community <= 2.3.5 within the 'public/view.php' component. The root cause is the failure to sanitize the 'doctype' request parameter before echoing it into HTML href attributes at eight distinct injection points (lines 187, 192, 196, 200, 262, 268, 276, and 288). An unauthenticated remote attacker can exploit this by inducing a logged-in user to visit a crafted URL. Successful exploitation allows the execution of arbitrary JavaScript in the context of the victim's session, which can be used to exfiltrate session cookies (PHPSESSID) or perform actions on behalf of the user. The vulnerability is reported to be chainable with CSRF flaws for automated account takeover.
Affected products
- Diskover Data diskover-community <= 2.3.5
Timeline
- 2026-03-08: other: Reported to vendor security team
- 2026-04-27: disclosed: Public disclosure and CVE assignment