CVE-2026-25154CWE-79

LocalSend has Stored XSS in Web Share Interface via Filename

Medium · published January 30, 2026

CVSS v3.1
6.1
EPSS
0%
Percentile
23.9
In the wild
Unconfirmed
What it is

LocalSend is a free, open-source app that allows users to share files and messages with nearby devices over their local network without needing an internet connection. In versions up to and including 1.17.0, when a user initiates a "Share via Link" session, the LocalSend application starts a local HTTP server to host the selected files. The client-side logic for this web interface is contained in `app/assets/web/main.js`. Note that at [0], the `handleFilesDisplay` function constructs the HTML for the file list by iterating over the files received from the server. Commit 8f3cec85aa29b2b13fed9b2f8e499e1ac9b0504c contains a patch.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00321 · 23.9th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-01-30T21:59Z
EPSS history
Timeline
  • 30 JAN 21:59Z
    LocalSend has Stored XSS in Web Share Interface via Filename
    cvelistv5