CVE-2026-7308CWE-79cross-site-scripting

CVE-2026-7308

Medium · published May 11, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
35.7
In the wild
Unconfirmed
What it is

An authenticated user with upload permission to a hosted repository can store content that causes arbitrary JavaScript to execute in the browser of any user who browses that repository directory via the HTML index page in Sonatype Nexus Repository versions 3.6.0 through versions before 3.92.0. This could allow the attacker to perform actions in the context of the victim's session.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00424 · 35.7th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-05-11T22:16Z
Affected products (1)
ProductVersionsFixed in
sonatype/nexus_repository_manager≥ 3.6.0, < 3.93.03.93.0
References (2)
https://help.sonatype.com/en/sonatype-nexus-repository-3-92-0-release-notes.html · 103e4ec9-0a87-450b-af77-479448ddef11https://support.sonatype.com/hc/en-us/articles/51592065985939 · 103e4ec9-0a87-450b-af77-479448ddef11
EPSS history
Timeline
  • 11 MAY 17:17Z
    Nexus Repository 3 - Stored Cross-Site Scripting (XSS) via HTML Browse Page
    cvelistv5