Executive brief
Quark Drive, a file management and automation tool, contains a security flaw in its system configuration page. An authorized user can save malicious code into the system settings that will run in the browser of any other administrator who views those settings. This could allow an attacker to steal login sessions or perform unauthorized actions on behalf of other users.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Quark Drive (quark-auto-save) versions prior to 0.8.5. The vulnerability is located in the System Configuration page where the Vue.js template uses the 'v-html' directive to render 'push_config' key names without proper sanitization. An authenticated attacker can submit a malicious payload via a POST request to the '/update' endpoint. This payload is persisted to disk and subsequently executed in the security context of any authenticated user who navigates to the System Configuration tab. This can be used to exfiltrate session cookies or perform arbitrary actions. The issue was fixed in version 0.8.5 by replacing 'v-html' with standard mustache interpolation '{{ }}' to ensure proper HTML escaping.
Affected products
- Cp0204 Quark Drive (quark-auto-save) before 0.8.5
Timeline
- 2026-04-17: patched: Fix committed to repository
- 2026-04-18: advisory: Version 0.8.5 released
- 2026-05-13: disclosed: CVE published and NVD entry created