THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-7308 (MEDIUM 5.4) — An authenticated user with upload permission to a hosted repository can store content that causes arbitrary JavaScript to execute in the browser of any user who browses that repository directory via the HTML index page in Sonatype Nexus Repository versions 3.6.0 through versions

[NVD] CVE-2026-7308 (MEDIUM 5.4) — An authenticated user with upload permission to a hosted repository can store content that causes arbitrary JavaScript to execute in the browser of any user who browses that repository directory via the HTML index page in Sonatype Nexus Repository versions 3.6.0 through versions

lownvdPublished 2026-05-11

CVE-2026-7308 CVSS: 5.4 MEDIUM Published: 2026-05-11T18:16:42.573

An authenticated user with upload permission to a hosted repository can store content that causes arbitrary JavaScript to execute in the browser of any user who browses that repository directory via the HTML index page in Sonatype Nexus Repository versions 3.6.0 through versions before 3.92.0. This could allow the attacker to perfo

MITRE ATT&CK techniques

JavaScriptT1059.007

Indicators of compromise

CVE-2026-7308cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-7308