CVE-2026-7308: An authenticated user with upload permission to a hosted repository can store content that causes arbitrary JavaScript to execute in the bro

Executive brief

Sonatype Nexus Repository is a software component manager used by developers to store and distribute code packages. A security vulnerability allows an authorized user with upload permissions to plant malicious scripts within a repository. If another user views that repository's directory through their web browser, the script could execute, potentially allowing the attacker to hijack the victim's session or perform unauthorized actions.

Technical details

A stored Cross-Site Scripting (XSS) vulnerability (CWE-79) exists in Sonatype Nexus Repository versions 3.6.0 through 3.91.1. An authenticated attacker with 'upload' permissions to a hosted repository can store malicious content that triggers arbitrary JavaScript execution when a victim browses the repository directory via the HTML index page. The attack requires minimal user interaction (viewing the directory) and allows the attacker to execute actions in the context of the victim's browser session. The issue is resolved in version 3.92.0.

Affected products

• Sonatype Nexus Repository 3.6.0 to 3.91.1

Timeline

• 2026-05-11: disclosed
• 2026-05-11: advisory

References

• https://help.sonatype.com/en/sonatype-nexus-repository-3-92-0-release-notes.html
• https://support.sonatype.com/hc/en-us/articles/51592065985939