CVE-2023-26961

MediumCVSS 4.8

Published: 08/08/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.41%

33th percentile - higher than 33% of all known CVEs

Summary

Alteryx Server 2022.1.1.42590 does not verify uploaded file types. This flaw allows attackers to upload arbitrary files (e.g., JavaScript for stored XSS) via the 'type' field in a JSON document in a PUT /gallery/api/media request.

Risk Assessment

An attacker can inject malicious JavaScript that executes in other users' browsers, leading to session theft, data leakage, or admin account takeover.

Recommendation

Update Alteryx Server to the latest patched version. As a workaround, restrict access to the /gallery/api/media endpoint to trusted users only.

Original NVD description (English source)

Alteryx Server 2022.1.1.42590 does not employ file type verification for uploaded files. This vulnerability allows attackers to upload arbitrary files (e.g., JavaScript content for stored XSS) via the type field in a JSON document within a PUT /gallery/api/media request.