{"id":"CVE-2026-25739","aliases":["GHSA-jxc4-54g3-j7vp","PYSEC-2026-2182"],"url":"https://o3.security/vulnerability/CVE-2026-25739","summary":"Indico affected by Cross-Site-Scripting via material uploads","details":"### Impact\nThere is a Cross-Site-Scripting vulnerability when uploading certain file types as materials.\n\n### Patches\nYou should to update to [Indico 3.3.10](https://github.com/indico/indico/releases/tag/v3.3.10) as soon as possible.\nSee [the docs](https://docs.getindico.io/en/stable/installation/upgrade/) for instructions on how to update.\n\nPlease be aware that to apply the fix itself updating is sufficient, but to benefit from the strict Content-Security-Policy we now apply by default for file downloads, you need to update your webserver config in case you use nginx with Indico's `STATIC_FILE_METHOD` set to `xaccelredirect` and add the following line to the `.xsf/indico/` location block (you can consult the Indico setup documentation for the full configuration snippet):\n\n```nginx\nadd_header Content-Security-Policy $upstream_http_content_security_policy;\n```\n\n### Workarounds\n- Use your webserver config to apply a strict CSP for material download endpoints.\n- Only let trustworthy users create content (including material uploads, which speakers can typically do as well) on Indico.\n\n### For more information\nIf you have any questions or comments about this advisory:\n\n- Open a thread in [our forum](https://talk.getindico.io/)\n- Email us privately at [indico-team@cern.ch](mailto:indico-team@cern.ch)","published":"2026-02-19T15:39:32.554Z","modified":"2026-08-12T03:51:40.537164449Z","cvss":{"score":5.4,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"indico","fixedVersion":"3.3.10"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/indico/indico/releases/tag/v3.3.10"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25739.json"},{"type":"ADVISORY","url":"https://github.com/indico/indico/security/advisories/GHSA-jxc4-54g3-j7vp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25739"},{"type":"PACKAGE","url":"https://github.com/indico/indico"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:40.537164449Z"}}