CVE ID: [CVE-2026-41031]
Date Published: [June 15, 2026]
Severity: HIGH (CVSS 7.5)
Vulnerability Summary
A Stored Cross-Site Scripting (XSS) vulnerability in the Media import functionality allows authenticated users to inject malicious JavaScript. When an admin visits a document containing the payload, their Bearer token is stolen, granting full application access.
Affected Versions
| Version | Status | Fix |
|---|---|---|
| 3.1.0 – 3.1.4 | ❌ Vulnerable | 3.1.5 (~Sep 2026) |
| 4.0.0 – 4.0.6 | ❌ Vulnerable | 4.0.7 (Available) |
| 4.0.7+ | ✅ Fixed | – |
| 3.1.5+ | ✅ Fixed | Coming Sep 2026 |
Recommendation
Immediate action: Upgrade to version 4.0.7 or later.
If stuck on 3.1.x, apply workarounds below until 3.1.8 releases.
How to Fix
For 4.0 Users
Download and install version 4.0.7 or later.
For 3.1 Users
- Best: Upgrade to 4.0.7+
- Temporary: Apply workarounds below until 3.1.5 (September 2026)
Workarounds (Until Patched)
- Restrict network access to Process Monitor (corporate network only)
- Educate users not to click links to Process Monitor from untrusted sources
Technical Details
Attack: An authenticated user uploads a malicious HTML file to the Media import feature. When an admin opens a link to that file, JavaScript executes and steals their Bearer token from browser storage.
Requirements:
- User must be authenticated to upload
- Admin must click the link/visit the page
- Token is exfiltrated without user knowledge
CWE: CWE-79 (Cross-site Scripting)
Contact
For questions, email: info@skilja.com
Discovered by: Michał Bartoszuk and Maciej Włodarczyk (@STM Cyber)