Is CVE-2026-90500 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-90500 being exploited in the wild.

How severe is CVE-2026-90500?

Medium severity, with a CVSS score of 6.3, published 13 September 2026.

Is there a fix for CVE-2026-90500?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-90500 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-90500?

Check whether you run Lenve Vhr at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-90500: Lenve VHR unrestricted file upload in avatar upload

CVE-2026-90500 · Severity: medium · CVSS 6.3 · Published 2026-09-13

Lenve VHR is a personnel management application used to manage employee information and avatars. An authenticated attacker can upload arbitrary file types (such as SVG files containing malicious scripts) through the avatar upload function, leading to stored cross-site scripting (XSS) attacks when the uploaded file is served by the application. This could allow attackers to steal employee credentials, perform unauthorized actions, or compromise the integrity of the system.

Technologies: Lenve Vhr. Vendors: Lenve.

Quick answers

Is CVE-2026-90500 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-90500 being exploited in the wild.
How severe is CVE-2026-90500?: Medium severity, with a CVSS score of 6.3, published 13 September 2026.
Which products and versions are affected?: Lenve Vhr 1.0-SNAPSHOT.
Is there a fix for CVE-2026-90500?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-90500 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-90500?: Check whether you run Lenve Vhr at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is an unrestricted file upload flaw (CWE-434) in the FastDFSUtils.upload() function used by the /hr/userface endpoint. The component fails to validate file types, extensions, or MIME types, allowing authenticated users to upload files with arbitrary extensions (e.g., SVG images containing JavaScript). The attack requires authentication (login) and a direct HTTP request to the upload endpoint. If the uploaded file is served inline from FastDFS or a CDN, the malicious script executes in users' browsers, resulting in stored XSS. Remediation involves implementing file type whitelisting, validating magic bytes, and sanitizing SVG content to strip executable scripts.

Affected products

Lenve VHR 1.0-SNAPSHOT

Timeline

2026-09-13: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.