CVE-2026-1466: 
NixOS vulnerability analysis and mitigation

CVE-2026-1466 is a Cross-Site Scripting (XSS) vulnerability in Jirafeau, an open-source file sharing application, affecting all versions before 4.7.1. The flaw resides in the file preview functionality, where an attacker can bypass MIME type validation by sending a manipulated HTTP request with an invalid MIME type (e.g., image), causing the browser to auto-detect and execute malicious SVG or HTML content. It was published on January 28, 2026, with a patch committed to the Jirafeau GitLab repository. It carries a CVSS v3.1 base score of 6.1 (Medium) (RedHat CVE, GitLab Commit).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). Jirafeau restricts file preview to MIME types beginning with image (excluding image/svg+xml), video, and audio to prevent XSS via dangerous file types like SVG and HTML. However, an attacker can bypass this check by uploading a malicious SVG file and sending a manipulated HTTP request with a truncated or invalid MIME type such as image (without a subtype). When the browser renders the preview, it performs MIME sniffing and auto-detects the actual SVG type, potentially executing embedded JavaScript. The fix adds the X-Content-Type-Options: nosniff HTTP response header to disable browser MIME sniffing (RedHat CVE, GitLab Commit). This vulnerability is related to prior Jirafeau XSS issues tracked as CVE-2022-30110, CVE-2024-12326, and CVE-2025-7066.

Successful exploitation allows an attacker to execute arbitrary JavaScript in a victim's browser within the context of the Jirafeau application. This can result in theft of session tokens or credentials, unauthorized actions performed on behalf of the victim, and potential defacement of the Jirafeau interface. The vulnerability requires user interaction (a victim must click to preview a malicious file) and has limited confidentiality and integrity impact (Low each), with no availability impact (RedHat CVE).

1. Reconnaissance: Identify publicly accessible Jirafeau instances running versions prior to 4.7.1 using web search or scanning tools.
2. Craft malicious SVG: Create an SVG file with embedded JavaScript (e.g., <svg xmlns="http://www.w3.org/2000/svg"><script>alert(document.cookie)</script></svg>).
3. Manipulate upload request: Upload the SVG file to the Jirafeau instance while intercepting the HTTP request (e.g., using Burp Suite) and modifying the Content-Type header to an invalid/truncated MIME type such as image (without a valid subtype like image/png).
4. Obtain preview link: After upload, retrieve the file's preview URL from the Jirafeau response.
5. Deliver link to victim: Send the preview URL to a target user via phishing or social engineering, inducing them to click the preview link.
6. Trigger XSS: When the victim's browser loads the preview, it performs MIME sniffing, detects the SVG type, and executes the embedded JavaScript — enabling session token theft, credential harvesting, or other malicious actions (RedHat CVE, GitLab Commit).

• Network: HTTP upload requests to Jirafeau with a Content-Type header set to an invalid or truncated MIME type (e.g., Content-Type: image without a subtype); unusual outbound requests from victim browsers to attacker-controlled domains following file preview actions.
• File System: Presence of SVG files in the Jirafeau upload directory containing <script> tags or JavaScript event handlers (e.g., onload, onerror).
• Logs: Web server access logs showing file upload requests with anomalous Content-Type values (e.g., bare image without subtype); subsequent access log entries for the preview endpoint of the same file from different IP addresses.

Upgrade Jirafeau to version 4.7.1 or later, which adds the X-Content-Type-Options: nosniff HTTP response header to disable browser MIME sniffing (GitLab Commit). As a temporary workaround prior to patching, administrators can apply the X-Content-Type-Options: nosniff header at the web server (e.g., nginx or Apache) level, restrict or disable file preview functionality, and implement WAF rules to block upload requests with malformed Content-Type headers. Users should also be advised to avoid previewing files from untrusted sources.

The vulnerability received routine coverage from automated vulnerability tracking services and aggregators shortly after disclosure. No notable researcher commentary, vendor statements beyond the patch commit, or significant media coverage has been identified for this CVE.