Stored script execution through an upload surface
The important lesson is not the filename alone: safe upload design needs agreement between validation, storage, response headers, and the origin that serves user-controlled content.
- Original severity
- P2 source-reported; not rescored by vulns.co
- Public source
- bugcrowd crowdstream
- Program / vendor
- National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
- Product / surface
- GLOBE platform file upload handling
- Weakness
- Stored cross-site scripting through file upload · CWE-79
- Affected boundary
- Content uploaded by one user and later rendered under a trusted web origin
- Disclosure date
- 2026-05-22
- Public status checked
- 2026-09-10
- Public attribution
- anthonyjsaab
What the evidence established
The public summary identifies a mismatch between upload validation and the response content type used for stored content.
Why the impact was credible
The source reported browser-side script execution when a stored upload was visited through the trusted origin.
Durable engineering lesson
The important lesson is not the filename alone: safe upload design needs agreement between validation, storage, response headers, and the origin that serves user-controlled content.
Control pattern
Allowlist file formats, validate content independently of names, isolate user uploads, and force safe download or non-executable content types.
Primary public disclosure
Upstream availability and wording can change. Public status was last checked 2026-09-10.