CVE-2026-40126
MediumCVSS 4.8Summary
OutSystems Service Center is vulnerable to DOM-based Cross-Site Scripting (XSS) that can be exploited by a low-privileged attacker via uploading a file with a malicious filename containing JavaScript code. The vulnerability exists in all locations where files can be attached and prepared for upload. Fixed in version 11.41.2.
Risk Assessment
Risk of malicious script execution in the application context, potentially leading to data theft or session hijacking.
Recommendation
Upgrade OutSystems Service Center to version 11.41.2 or later and validate filenames before upload.
Original NVD description (English source)
OutSystems Service Center is vulnerable to a DOM-based Cross-Site Scripting (XSS) attack that can be exploited by a low-privileged attacker via the upload of a file with a malicious filename containing JavaScript code. The vulnerability exists in all locations where a file can be attached and prepared for upload to the server. This issue was fixed in OutSystems Service Center version 11.41.2