CVE-2026-110103

bbs-go version 4.4.6 and earlier is vulnerable to a stored cross-site scripting (XSS) vulnerability. The root cause is that the application allows authenticated users to upload HTML or SVG files by spoofing the multipart Content-Type during a POST request to /api/upload . Attackers can upload doc...