CVE-2026-35608

CVE-2026-35608 is a stored cross-site scripting (XSS) vulnerability in QuickDrop, a file sharing application, affecting versions prior to 1.5.3. The flaw exists in the file preview endpoint, where attackers can upload malicious SVG files containing JavaScript payloads through the /api/file/upload-chunk endpoint. When other users access the file preview, the embedded script executes within the application's domain, potentially compromising user sessions and sensitive data. The vulnerability has a CVSS score of 6.1 (Medium severity) with a network-based attack vector requiring no authentication but user interaction. The attack is relatively simple to execute with low complexity, and the impact includes confidentiality and integrity breaches with cross-site implications. The EPSS score of 0.00031 indicates this vulnerability has minimal probabilistic likelihood of exploitation compared to broader CVE populations. There is currently no evidence of active exploitation or public exploit code availability. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog and remains inactive on exploit tracking platforms. The moderate FAUCET risk score of 34.0/100 reflects the theoretical risk nature. Organizations should prioritize upgrading to version 1.5.3 or later to remediate this vulnerability, though the low exploitation activity suggests this is not an immediate critical threat.