CVE-2026-1126

CVE-2026-1126 describes an unrestricted file upload vulnerability in the SVG File Handler component of lwj flow, specifically within the uploadFile function. This flaw allows an authenticated remote attacker to upload arbitrary files, potentially leading to information disclosure, modification, or denial of service. With a CVSS score of 6.3 (Medium), the attack is network-based and low complexity, requiring low privileges and no user interaction. While the exploit has been publicly disclosed, there is no evidence of active exploitation, and no known exploit intelligence or significant community discussion has been observed.