CVE-2025-26514CWE-79

CVE-2025-26514 Reflected Cross-Site Scripting Vulnerability in StorageGRID (formerly StorageGRID Webscale)

Medium · published September 19, 2025

CVSS v3.1
6.4
EPSS
0%
Percentile
14.3
In the wild
Unconfirmed
What it is

StorageGRID (formerly

StorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 are

susceptible to a Reflected Cross-Site Scripting vulnerability.

Successful exploit could allow an attacker to view or modify

configuration settings or add or modify user accounts but requires the

attacker to know specific information about the target instance and then

trick a privileged user into clicking a specially crafted link.

The record
Technical detail
CVSS v3.1
6.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00241 · 14.3th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-09-19T18:31Z
EPSS history
Timeline
  • 19 SEP 18:31Z
    CVE-2025-26514 Reflected Cross-Site Scripting Vulnerability in StorageGRID (formerly StorageGRID Webscale)
    cvelistv5