Is CVE-2026-63147 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-63147 being exploited in the wild.

How severe is CVE-2026-63147?

Medium severity, with a CVSS score of 5.4, published 13 October 2026.

Which products and versions are affected?

Omnispace Agora Project before 26.10.0.

Is there a fix for CVE-2026-63147?

Yes: fixed in 26.10.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-63147 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-63147?

Check whether you run Omnispace Agora Project at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-63147: Omnispace Agora Project stored cross-site scripting in file upload

CVE-2026-63147 · Severity: medium · CVSS 5.4 · Published 2026-10-13

Omnispace Agora Project is a collaborative workspace platform for file sharing, calendars, tasks, and team communication. The vulnerability allows authenticated users to inject malicious scripts by uploading files with specially crafted names containing HTML or JavaScript code, which then execute in other users' browsers when they view the file listing. An attacker can hijack user sessions, steal credentials, or spread malware within the organization.

Technologies: Omnispace Agora Project. Vendors: Omnispace.

Quick answers

Is CVE-2026-63147 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-63147 being exploited in the wild.
How severe is CVE-2026-63147?: Medium severity, with a CVSS score of 5.4, published 13 October 2026.
Which products and versions are affected?: Omnispace Agora Project before 26.10.0.
Is there a fix for CVE-2026-63147?: Yes: fixed in 26.10.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63147 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-63147?: Check whether you run Omnispace Agora Project at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 26.10.0

Technical details

A stored XSS vulnerability exists in the file upload handler where filenames containing HTML/script markup (such as SVG with onload payloads) bypass input validation because file names arrive via $_FILES rather than the filtered $_GET/$_POST parameters. The unsanitized filename is stored in the database and rendered to other users' browsers without sanitization, leading to script execution in their security context. A fix is available in version 26.10.0 and later.

Affected products

Omnispace Agora Project before 26.10.0

Timeline

2026-10-13: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.