CVE-2026-75529 - Stored Cross-Site Scripting via MIME-Type Confusion in PDF Downloads of Pandora
Brief
CVE ID : CVE-2026-75529
Published : Aug. 17, 2026, 8:52 p. m.
- 15 minutes ago
Description : Pandora is affected by a stored cross-site scripting vulnerability in the PDF download functionality. The /task-download/ /... /pdf endpoint verifies that the submitted file is a PDF using Pandora's content-based file-type detection, but previously returned the file using send_file(task. file. path) without explicitly specifying the MIME type or forcing it to be downloaded as an attachment.
Because Flask determines the response MIME type from the filename when a path is supplied, an attacker could submit a file whose content is recognized by Pandora as a PDF while its filename or extension causes the download endpoint to return it with a different, potentially active MIME type.