CVE-2026-33653

Uploady is vulnerable to a stored XSS in versions before 3.1.2 due to improper sanitization of filenames during upload. A malicious filename can execute JavaScript when displayed in the file list or details page. The issue is fixed in version 3.1.2. The available connected documents confirm the a...