Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
6 vulnerabilities by Unblu inc.
CVE-2026-8152 (GCVE-0-2026-8152)
Vulnerability from nvd – Published: 2026-07-22 12:21 – Updated: 2026-07-22 18:55
VLAI
EPSS
VEX
Title
Unblu Spark Open Redirect leading to DOM-Based XSS
Summary
Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack.
When Unblu Spark is deployed with com.unblu.identifier.siteEmbeddedSetup=true, it runs in the same origin as the host application. Any JavaScript injected through this vulnerability therefore executes with full access to the host application's cookies, DOM, and same-origin APIs — an attacker can reach all resources of the host application, not just Unblu's. This expanded blast radius is the reason on-premises deployments using this configuration are rated CRITICAL.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://docs.unblu.com/latest/security-bulletins/… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Unblu inc. | Unblu Spark |
Affected:
0 , ≤ 8.36.1
(semver)
Unaffected: 8.36.1-hotfix.0 (semver) Unaffected: 8.37.0 (semver) |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8152",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-22T18:54:56.321413Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-22T18:55:07.732Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"platforms": [
"On-premises",
"Cloud"
],
"product": "Unblu Spark",
"vendor": "Unblu inc.",
"versions": [
{
"lessThanOrEqual": "8.36.1",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "8.36.1-hotfix.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "8.37.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Kenan Karalioglu (chef_shell) via YesWeHack"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003eUnblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack.\u003c/div\u003e\u003cbr\u003e\u003cdiv\u003eWhen Unblu Spark is deployed with \u003ccode\u003ecom.unblu.identifier.siteEmbeddedSetup=true\u003c/code\u003e, it runs in the same origin as the host application. Any JavaScript injected through this vulnerability therefore executes with full access to the host application\u0027s cookies, DOM, and same-origin APIs \u2014 an attacker can reach all resources of the host application, not just Unblu\u0027s. This expanded blast radius is the reason on-premises deployments using this configuration are rated CRITICAL.\u003c/div\u003e\u003c/div\u003e\u003cp\u003e\u003cbr\u003e\u003c/p\u003e"
}
],
"value": "Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack.\n\n\nWhen Unblu Spark is deployed with com.unblu.identifier.siteEmbeddedSetup=true, it runs in the same origin as the host application. Any JavaScript injected through this vulnerability therefore executes with full access to the host application\u0027s cookies, DOM, and same-origin APIs \u2014 an attacker can reach all resources of the host application, not just Unblu\u0027s. This expanded blast radius is the reason on-premises deployments using this configuration are rated CRITICAL."
}
],
"impacts": [
{
"capecId": "CAPEC-588",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-588 \u2014 DOM-Based XSS"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "On-premises deployment (same site)"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "Cloud deployment"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601 URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-22T12:21:28.977Z",
"orgId": "455daabc-a392-441d-aa46-37d35189897c",
"shortName": "NCSC.ch"
},
"references": [
{
"name": "Unblu Security Advisories",
"tags": [
"vendor-advisory"
],
"url": "https://docs.unblu.com/latest/security-bulletins/#UBL-2026-001"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eIn the fix versions listed above, Unblu Spark validates all user-supplied redirects through the same redirect filter.\u003c/div\u003e\u003cbr\u003e\u003cdiv\u003eAfter upgrading, please review your redirect filter configuration. The defaults restrict redirects to the current origin (\u003ccode\u003edocument.location.origin\u003c/code\u003e).\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cbr\u003e"
}
],
"value": "In the fix versions listed above, Unblu Spark validates all user-supplied redirects through the same redirect filter.\n\n\nAfter upgrading, please review your redirect filter configuration. The defaults restrict redirects to the current origin (document.location.origin)."
}
],
"source": {
"advisory": "UBL-2026-001",
"discovery": "EXTERNAL"
},
"title": "Unblu Spark Open Redirect leading to DOM-Based XSS",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eIf you cannot upgrade immediately, either of the following measures prevents exploitation:\u003c/div\u003e\u003cdiv\u003e\u003cul\u003e\u003cli\u003eEnable the built-in Content Security Policy by setting\u0026nbsp;\u003ccode\u003ecom.unblu.contentsecuritypolicy.mode=on\u003c/code\u003e. The CSP blocks the injected JavaScript from executing and prevents the exploit from succeeding. \u003cb\u003eNote:\u003c/b\u003e\u0026nbsp;this protection is only effective on Unblu Spark \u003cb\u003e7.56.2 or later\u003c/b\u003e\u0026nbsp;in the 7.x series and \u003cb\u003e8.19.1 or later\u003c/b\u003e\u0026nbsp;in the 8.x series, where\u0026nbsp;\u003ccode\u003eunsafe-inline\u003c/code\u003e\u0026nbsp;was removed from the script source policy. Earlier versions ship a CSP that still permits\u0026nbsp;\u003ccode\u003eunsafe-inline\u003c/code\u003e\u0026nbsp;and are not protected by this workaround.\u003c/li\u003e\u003cli\u003eConfigure a WAF rule to block requests that carry a malicious payload in the\u0026nbsp;\u003ccode\u003eredirectOnFailure\u003c/code\u003e\u0026nbsp;parameter (in particular, values containing a\u0026nbsp;\u003ccode\u003ejavascript:\u003c/code\u003e\u0026nbsp;scheme or obfuscated variants such as\u0026nbsp;\u003ccode\u003ejava%0ascript:\u003c/code\u003e).\u003c/li\u003e\u003c/ul\u003e\u003c/div\u003e\u003cbr\u003e\u003cbr\u003e"
}
],
"value": "If you cannot upgrade immediately, either of the following measures prevents exploitation:\n\n * Enable the built-in Content Security Policy by setting\u00a0com.unblu.contentsecuritypolicy.mode=on. The CSP blocks the injected JavaScript from executing and prevents the exploit from succeeding. Note:\u00a0this protection is only effective on Unblu Spark 7.56.2 or later\u00a0in the 7.x series and 8.19.1 or later\u00a0in the 8.x series, where\u00a0unsafe-inline\u00a0was removed from the script source policy. Earlier versions ship a CSP that still permits\u00a0unsafe-inline\u00a0and are not protected by this workaround.\n * Configure a WAF rule to block requests that carry a malicious payload in the\u00a0redirectOnFailure\u00a0parameter (in particular, values containing a\u00a0javascript:\u00a0scheme or obfuscated variants such as\u00a0java%0ascript:)."
}
],
"x_generator": {
"engine": "manual"
}
}
},
"cveMetadata": {
"assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
"assignerShortName": "NCSC.ch",
"cveId": "CVE-2026-8152",
"datePublished": "2026-07-22T12:21:28.977Z",
"dateReserved": "2026-05-08T08:12:13.325Z",
"dateUpdated": "2026-07-22T18:55:07.732Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-3519 (GCVE-0-2025-3519)
Vulnerability from nvd – Published: 2025-04-22 08:51 – Updated: 2025-04-22 18:55
VLAI
EPSS
VEX
Title
Replace uploaded files knowing the file upload ID
Summary
An authorization bypass in Unblu Spark allows a participant of a conversation to replace an existing, uploaded file.
Every uploaded file in Unblu gets assigned with a randomly generated Universally Unique ID (UUID). In case a participant of this or another conversation gets access to such a file ID, it can be used to replace the file without changing the file name and details or the name of the user who uploaded the file. During the upload, file interception and allowed file type rules are still applied correctly.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Unblu inc. | Unblu Spark |
Unaffected:
8.13.1
(semver)
Affected: 8.0.0 , ≤ 8.12.1 (semver) |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-3519",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-22T18:55:22.227888Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-22T18:55:44.071Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Unblu Spark",
"vendor": "Unblu inc.",
"versions": [
{
"status": "unaffected",
"version": "8.13.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.12.1",
"status": "affected",
"version": "8.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Andrei Dabrakou of Citadelo (andrei.dabrakou@citadelo.com)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An authorization bypass\u0026nbsp;in\u0026nbsp;Unblu Spark allows a\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eparticipant of a conversation\u0026nbsp;\u003c/span\u003eto replace an existing, uploaded file.\u003cbr\u003e\u003cbr\u003eEvery uploaded file in Unblu gets assigned with a randomly generated Universally Unique ID (UUID). In case a participant of this or another conversation gets access to such a file ID, it can be used to replace the file without changing the file name and details or the name of the user who uploaded the file. During the upload, file interception and allowed file type rules are still applied correctly. \u003cbr\u003e"
}
],
"value": "An authorization bypass\u00a0in\u00a0Unblu Spark allows a\u00a0participant of a conversation\u00a0to replace an existing, uploaded file.\n\nEvery uploaded file in Unblu gets assigned with a randomly generated Universally Unique ID (UUID). In case a participant of this or another conversation gets access to such a file ID, it can be used to replace the file without changing the file name and details or the name of the user who uploaded the file. During the upload, file interception and allowed file type rules are still applied correctly."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-04-22T08:51:41.681Z",
"orgId": "455daabc-a392-441d-aa46-37d35189897c",
"shortName": "NCSC.ch"
},
"references": [
{
"url": "https://www.unblu.com/en/docs/latest/security-bulletins/#UBL-2025-001"
}
],
"source": {
"advisory": "UBL-2025-001",
"discovery": "EXTERNAL"
},
"title": "Replace uploaded files knowing the file upload ID",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
"assignerShortName": "NCSC.ch",
"cveId": "CVE-2025-3519",
"datePublished": "2025-04-22T08:51:41.681Z",
"dateReserved": "2025-04-11T14:18:18.443Z",
"dateUpdated": "2025-04-22T18:55:44.071Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-3518 (GCVE-0-2025-3518)
Vulnerability from nvd – Published: 2025-04-22 08:49 – Updated: 2025-04-24 14:59
VLAI
EPSS
VEX
Title
File upload functionality possible even when disabled
Summary
It technically possible for a user to upload a file to a conversation despite the file upload functionality being disabled.
The file upload functionality can be enabled or disabled for specific use cases through configuration. In case the functionality is disabled for at least one use case, the system nevertheless allows files to be uploaded through direct API requests. During the upload file, interception and allowed file type rules are still applied correctly.
If file sharing is generally enabled, this issue is not of concern.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-284 - Improper Access Control
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Unblu inc. | Unblu Spark |
Unaffected:
7.54.1
(semver)
Unaffected: 8.13.1 (semver) Affected: 7.0.0 , ≤ 7.53.4 (semver) Affected: 8.0.0 , ≤ 8.12.1 (semver) |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-3518",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-22T18:57:26.161061Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-04-24T14:59:31.675Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Unblu Spark",
"vendor": "Unblu inc.",
"versions": [
{
"status": "unaffected",
"version": "7.54.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "8.13.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.53.4",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.12.1",
"status": "affected",
"version": "8.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Andrei Dabrakou of Citadelo (andrei.dabrakou@citadelo.com)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "It technically possible for a user to upload a file to a conversation despite the file upload functionality being disabled.\u003cbr\u003e\u003cbr\u003eThe file upload functionality can be enabled or disabled for specific use cases through configuration. In case the functionality is disabled for at least one use case, the system nevertheless allows files to be uploaded through direct API requests. During the upload file, interception and allowed file type rules are still applied correctly.\u003cbr\u003e\u003cbr\u003eIf file sharing is generally enabled, this issue is not of concern. \u003cbr\u003e \u003cbr\u003e"
}
],
"value": "It technically possible for a user to upload a file to a conversation despite the file upload functionality being disabled.\n\nThe file upload functionality can be enabled or disabled for specific use cases through configuration. In case the functionality is disabled for at least one use case, the system nevertheless allows files to be uploaded through direct API requests. During the upload file, interception and allowed file type rules are still applied correctly.\n\nIf file sharing is generally enabled, this issue is not of concern."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-04-22T08:51:07.759Z",
"orgId": "455daabc-a392-441d-aa46-37d35189897c",
"shortName": "NCSC.ch"
},
"references": [
{
"url": "https://www.unblu.com/en/docs/latest/security-bulletins/#UBL-2025-002"
}
],
"source": {
"advisory": "UBL-2025-002",
"discovery": "EXTERNAL"
},
"title": "File upload functionality possible even when disabled",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
"assignerShortName": "NCSC.ch",
"cveId": "CVE-2025-3518",
"datePublished": "2025-04-22T08:49:56.073Z",
"dateReserved": "2025-04-11T14:18:16.805Z",
"dateUpdated": "2025-04-24T14:59:31.675Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-8152 (GCVE-0-2026-8152)
Vulnerability from cvelistv5 – Published: 2026-07-22 12:21 – Updated: 2026-07-22 18:55
VLAI
EPSS
VEX
Title
Unblu Spark Open Redirect leading to DOM-Based XSS
Summary
Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack.
When Unblu Spark is deployed with com.unblu.identifier.siteEmbeddedSetup=true, it runs in the same origin as the host application. Any JavaScript injected through this vulnerability therefore executes with full access to the host application's cookies, DOM, and same-origin APIs — an attacker can reach all resources of the host application, not just Unblu's. This expanded blast radius is the reason on-premises deployments using this configuration are rated CRITICAL.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://docs.unblu.com/latest/security-bulletins/… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Unblu inc. | Unblu Spark |
Affected:
0 , ≤ 8.36.1
(semver)
Unaffected: 8.36.1-hotfix.0 (semver) Unaffected: 8.37.0 (semver) |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8152",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-22T18:54:56.321413Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-22T18:55:07.732Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"platforms": [
"On-premises",
"Cloud"
],
"product": "Unblu Spark",
"vendor": "Unblu inc.",
"versions": [
{
"lessThanOrEqual": "8.36.1",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "8.36.1-hotfix.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "8.37.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Kenan Karalioglu (chef_shell) via YesWeHack"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003eUnblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack.\u003c/div\u003e\u003cbr\u003e\u003cdiv\u003eWhen Unblu Spark is deployed with \u003ccode\u003ecom.unblu.identifier.siteEmbeddedSetup=true\u003c/code\u003e, it runs in the same origin as the host application. Any JavaScript injected through this vulnerability therefore executes with full access to the host application\u0027s cookies, DOM, and same-origin APIs \u2014 an attacker can reach all resources of the host application, not just Unblu\u0027s. This expanded blast radius is the reason on-premises deployments using this configuration are rated CRITICAL.\u003c/div\u003e\u003c/div\u003e\u003cp\u003e\u003cbr\u003e\u003c/p\u003e"
}
],
"value": "Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack.\n\n\nWhen Unblu Spark is deployed with com.unblu.identifier.siteEmbeddedSetup=true, it runs in the same origin as the host application. Any JavaScript injected through this vulnerability therefore executes with full access to the host application\u0027s cookies, DOM, and same-origin APIs \u2014 an attacker can reach all resources of the host application, not just Unblu\u0027s. This expanded blast radius is the reason on-premises deployments using this configuration are rated CRITICAL."
}
],
"impacts": [
{
"capecId": "CAPEC-588",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-588 \u2014 DOM-Based XSS"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "On-premises deployment (same site)"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "Cloud deployment"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601 URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-22T12:21:28.977Z",
"orgId": "455daabc-a392-441d-aa46-37d35189897c",
"shortName": "NCSC.ch"
},
"references": [
{
"name": "Unblu Security Advisories",
"tags": [
"vendor-advisory"
],
"url": "https://docs.unblu.com/latest/security-bulletins/#UBL-2026-001"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eIn the fix versions listed above, Unblu Spark validates all user-supplied redirects through the same redirect filter.\u003c/div\u003e\u003cbr\u003e\u003cdiv\u003eAfter upgrading, please review your redirect filter configuration. The defaults restrict redirects to the current origin (\u003ccode\u003edocument.location.origin\u003c/code\u003e).\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cbr\u003e"
}
],
"value": "In the fix versions listed above, Unblu Spark validates all user-supplied redirects through the same redirect filter.\n\n\nAfter upgrading, please review your redirect filter configuration. The defaults restrict redirects to the current origin (document.location.origin)."
}
],
"source": {
"advisory": "UBL-2026-001",
"discovery": "EXTERNAL"
},
"title": "Unblu Spark Open Redirect leading to DOM-Based XSS",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eIf you cannot upgrade immediately, either of the following measures prevents exploitation:\u003c/div\u003e\u003cdiv\u003e\u003cul\u003e\u003cli\u003eEnable the built-in Content Security Policy by setting\u0026nbsp;\u003ccode\u003ecom.unblu.contentsecuritypolicy.mode=on\u003c/code\u003e. The CSP blocks the injected JavaScript from executing and prevents the exploit from succeeding. \u003cb\u003eNote:\u003c/b\u003e\u0026nbsp;this protection is only effective on Unblu Spark \u003cb\u003e7.56.2 or later\u003c/b\u003e\u0026nbsp;in the 7.x series and \u003cb\u003e8.19.1 or later\u003c/b\u003e\u0026nbsp;in the 8.x series, where\u0026nbsp;\u003ccode\u003eunsafe-inline\u003c/code\u003e\u0026nbsp;was removed from the script source policy. Earlier versions ship a CSP that still permits\u0026nbsp;\u003ccode\u003eunsafe-inline\u003c/code\u003e\u0026nbsp;and are not protected by this workaround.\u003c/li\u003e\u003cli\u003eConfigure a WAF rule to block requests that carry a malicious payload in the\u0026nbsp;\u003ccode\u003eredirectOnFailure\u003c/code\u003e\u0026nbsp;parameter (in particular, values containing a\u0026nbsp;\u003ccode\u003ejavascript:\u003c/code\u003e\u0026nbsp;scheme or obfuscated variants such as\u0026nbsp;\u003ccode\u003ejava%0ascript:\u003c/code\u003e).\u003c/li\u003e\u003c/ul\u003e\u003c/div\u003e\u003cbr\u003e\u003cbr\u003e"
}
],
"value": "If you cannot upgrade immediately, either of the following measures prevents exploitation:\n\n * Enable the built-in Content Security Policy by setting\u00a0com.unblu.contentsecuritypolicy.mode=on. The CSP blocks the injected JavaScript from executing and prevents the exploit from succeeding. Note:\u00a0this protection is only effective on Unblu Spark 7.56.2 or later\u00a0in the 7.x series and 8.19.1 or later\u00a0in the 8.x series, where\u00a0unsafe-inline\u00a0was removed from the script source policy. Earlier versions ship a CSP that still permits\u00a0unsafe-inline\u00a0and are not protected by this workaround.\n * Configure a WAF rule to block requests that carry a malicious payload in the\u00a0redirectOnFailure\u00a0parameter (in particular, values containing a\u00a0javascript:\u00a0scheme or obfuscated variants such as\u00a0java%0ascript:)."
}
],
"x_generator": {
"engine": "manual"
}
}
},
"cveMetadata": {
"assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
"assignerShortName": "NCSC.ch",
"cveId": "CVE-2026-8152",
"datePublished": "2026-07-22T12:21:28.977Z",
"dateReserved": "2026-05-08T08:12:13.325Z",
"dateUpdated": "2026-07-22T18:55:07.732Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-3519 (GCVE-0-2025-3519)
Vulnerability from cvelistv5 – Published: 2025-04-22 08:51 – Updated: 2025-04-22 18:55
VLAI
EPSS
VEX
Title
Replace uploaded files knowing the file upload ID
Summary
An authorization bypass in Unblu Spark allows a participant of a conversation to replace an existing, uploaded file.
Every uploaded file in Unblu gets assigned with a randomly generated Universally Unique ID (UUID). In case a participant of this or another conversation gets access to such a file ID, it can be used to replace the file without changing the file name and details or the name of the user who uploaded the file. During the upload, file interception and allowed file type rules are still applied correctly.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Unblu inc. | Unblu Spark |
Unaffected:
8.13.1
(semver)
Affected: 8.0.0 , ≤ 8.12.1 (semver) |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-3519",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-22T18:55:22.227888Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-22T18:55:44.071Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Unblu Spark",
"vendor": "Unblu inc.",
"versions": [
{
"status": "unaffected",
"version": "8.13.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.12.1",
"status": "affected",
"version": "8.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Andrei Dabrakou of Citadelo (andrei.dabrakou@citadelo.com)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An authorization bypass\u0026nbsp;in\u0026nbsp;Unblu Spark allows a\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eparticipant of a conversation\u0026nbsp;\u003c/span\u003eto replace an existing, uploaded file.\u003cbr\u003e\u003cbr\u003eEvery uploaded file in Unblu gets assigned with a randomly generated Universally Unique ID (UUID). In case a participant of this or another conversation gets access to such a file ID, it can be used to replace the file without changing the file name and details or the name of the user who uploaded the file. During the upload, file interception and allowed file type rules are still applied correctly. \u003cbr\u003e"
}
],
"value": "An authorization bypass\u00a0in\u00a0Unblu Spark allows a\u00a0participant of a conversation\u00a0to replace an existing, uploaded file.\n\nEvery uploaded file in Unblu gets assigned with a randomly generated Universally Unique ID (UUID). In case a participant of this or another conversation gets access to such a file ID, it can be used to replace the file without changing the file name and details or the name of the user who uploaded the file. During the upload, file interception and allowed file type rules are still applied correctly."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-04-22T08:51:41.681Z",
"orgId": "455daabc-a392-441d-aa46-37d35189897c",
"shortName": "NCSC.ch"
},
"references": [
{
"url": "https://www.unblu.com/en/docs/latest/security-bulletins/#UBL-2025-001"
}
],
"source": {
"advisory": "UBL-2025-001",
"discovery": "EXTERNAL"
},
"title": "Replace uploaded files knowing the file upload ID",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
"assignerShortName": "NCSC.ch",
"cveId": "CVE-2025-3519",
"datePublished": "2025-04-22T08:51:41.681Z",
"dateReserved": "2025-04-11T14:18:18.443Z",
"dateUpdated": "2025-04-22T18:55:44.071Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-3518 (GCVE-0-2025-3518)
Vulnerability from cvelistv5 – Published: 2025-04-22 08:49 – Updated: 2025-04-24 14:59
VLAI
EPSS
VEX
Title
File upload functionality possible even when disabled
Summary
It technically possible for a user to upload a file to a conversation despite the file upload functionality being disabled.
The file upload functionality can be enabled or disabled for specific use cases through configuration. In case the functionality is disabled for at least one use case, the system nevertheless allows files to be uploaded through direct API requests. During the upload file, interception and allowed file type rules are still applied correctly.
If file sharing is generally enabled, this issue is not of concern.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-284 - Improper Access Control
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Unblu inc. | Unblu Spark |
Unaffected:
7.54.1
(semver)
Unaffected: 8.13.1 (semver) Affected: 7.0.0 , ≤ 7.53.4 (semver) Affected: 8.0.0 , ≤ 8.12.1 (semver) |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-3518",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-22T18:57:26.161061Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-04-24T14:59:31.675Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Unblu Spark",
"vendor": "Unblu inc.",
"versions": [
{
"status": "unaffected",
"version": "7.54.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "8.13.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.53.4",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.12.1",
"status": "affected",
"version": "8.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Andrei Dabrakou of Citadelo (andrei.dabrakou@citadelo.com)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "It technically possible for a user to upload a file to a conversation despite the file upload functionality being disabled.\u003cbr\u003e\u003cbr\u003eThe file upload functionality can be enabled or disabled for specific use cases through configuration. In case the functionality is disabled for at least one use case, the system nevertheless allows files to be uploaded through direct API requests. During the upload file, interception and allowed file type rules are still applied correctly.\u003cbr\u003e\u003cbr\u003eIf file sharing is generally enabled, this issue is not of concern. \u003cbr\u003e \u003cbr\u003e"
}
],
"value": "It technically possible for a user to upload a file to a conversation despite the file upload functionality being disabled.\n\nThe file upload functionality can be enabled or disabled for specific use cases through configuration. In case the functionality is disabled for at least one use case, the system nevertheless allows files to be uploaded through direct API requests. During the upload file, interception and allowed file type rules are still applied correctly.\n\nIf file sharing is generally enabled, this issue is not of concern."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-04-22T08:51:07.759Z",
"orgId": "455daabc-a392-441d-aa46-37d35189897c",
"shortName": "NCSC.ch"
},
"references": [
{
"url": "https://www.unblu.com/en/docs/latest/security-bulletins/#UBL-2025-002"
}
],
"source": {
"advisory": "UBL-2025-002",
"discovery": "EXTERNAL"
},
"title": "File upload functionality possible even when disabled",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
"assignerShortName": "NCSC.ch",
"cveId": "CVE-2025-3518",
"datePublished": "2025-04-22T08:49:56.073Z",
"dateReserved": "2025-04-11T14:18:16.805Z",
"dateUpdated": "2025-04-24T14:59:31.675Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}