CVE-2026-25739: Indico Cross-Site Scripting Vulnerability via Material Uploads
Summary
CVE-2026-25739: Indico Affected by Cross-Site-Scripting via material uploads. Affects indico versions < 3.3.10. Fixed in 3.3.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Indico is an open-source event management software that allows users to create, manage, and host events. It provides features such as material uploads, registration, and scheduling. However, it has been found to be vulnerable to Cross-Site Scripting (XSS) attacks when certain file types are uploaded as materials, potentially compromising user data and application integrity.
Vulnerability Detail
The vulnerability arises from inadequate validation of uploaded files, allowing attackers to inject malicious scripts through specific file types. This can lead to unauthorized actions being performed on behalf of users, data theft, or redirection to malicious sites. The vulnerability is classified under CWE-79, which pertains to improper neutralization of input during web page generation.
How To Fix
Latest published version: 3.3.14 as of 22 Oct 2026
pip install --upgrade "indico==3.3.14"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.3.10
This is the first release that contains the fix.
pip install --upgrade "indico==3.3.10"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can apply a strict Content Security Policy (CSP) for material download endpoints in their webserver configuration. Furthermore, it is advisable to restrict content creation permissions to trustworthy users only.
Conclusion
In summary, the Cross-Site Scripting vulnerability in Indico can pose significant risks to users and their data. It is crucial to update to the patched version 3.3.10 and implement recommended security measures to mitigate these risks.
See every vulnerability recorded for indico →
FAQ
The vulnerability is a Cross-Site Scripting (XSS) issue that allows attackers to inject malicious scripts through uploaded materials.
If you are using a version prior to 3.3.10, your installation is vulnerable to this issue.
Exploitation of this vulnerability can lead to unauthorized actions, data theft, and compromised user accounts.
Yes, you can use Vulert to monitor and alert in real-time for open-source vulnerabilities in your software without needing to access the code or installation.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for indico.
