LOWVulnerability
CVE-2026-90453
A file-upload handler redirects the authenticated client's browser to a URL taken directly from that same request's Referer header, without validating it against the application's own origin. This allows an authenticated attacker to craft a request that causes another user's browser to be redirected to an arbitrary external destination after completing an upload.
Properties
- cve_id
- CVE-2026-90453
- signal_observed_at
- 2026-09-21T23:07:07+00:00
- published_at
- 2026-09-11T22:16:47.630
- last_modified
- 2026-09-18T19:40:31.053
Related Entities (2)
HAS_WEAKNESS (1)
→[Weakness]URL Redirection to Untrusted Site ('Open Redirect')
DESCRIBED_BY (1)
→[Source]NVD
Explore deeper with Ninja Signal's threat intelligence graph