Executive brief
Pingvin Share, a self-hosted file-sharing platform, contains a security flaw in its sign-in process. An attacker can create a malicious link that, if clicked by a logged-in user, executes unauthorized code in their web browser. This could allow an attacker to perform actions on behalf of the user or access sensitive information within the application.
Technical details
A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the Sign-in Auto-Redirect component of Pingvin Share. The 'getServerSideProps' function in 'frontend/src/pages/auth/signIn.tsx' retrieves a 'redirect' query parameter from the URL and passes it to 'router.replace' without sufficient validation. Because 'router.replace' in the underlying Next.js framework can execute 'javascript:' URIs, an attacker can craft a URL that executes arbitrary code in the context of an authenticated user's session. Exploitation requires the victim to be logged in and to click a specially crafted link. As of the advisory date, the vendor has not responded to disclosure attempts.
Affected products
- stonith404 Pingvin Share up to 1.13.0
Timeline
- 2026-03-08: disclosed: Vulnerability discovered and reported to maintainer.
- 2026-05-26: advisory: Public disclosure via VulDB and NVD.