CVE-2025-70849

PoC —

CVSS 3.1

6.1 medium

EPSS

<1%p17

Published

Feb 3, 2026 (Feb 3, 2026)

Modified

Jun 17, 2026

Description

Arbitrary File Upload in podinfo thru 6.9.0 allows unauthenticated attackers to upload arbitrary files via crafted POST request to the /store endpoint. The application renders uploaded content without a restrictive Content-Security-Policy (CSP) or adequate Content-Type validation, leading to Stored Cross-Site Scripting (XSS).

Vendors: stefanprodan
Products: podinfo
Weakness: CWE-79, CWE-434
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news0 stories

No ingested article mentions this CVE yet.