CVE-2026-124491

SunEditor versions prior to 3.4.0 are susceptible to a stored cross-site scripting (XSS) vulnerability within the FileUpload plugin 's create() method. The root cause is the assignment of server-returned file names to innerHTML without proper escaping. Attackers can upload files with malicious, H...