CVE-2026-1879 | THREATINT

Home

Description

A vulnerability was detected in Harvard University IQSS Dataverse up to 6.8. This affects an unknown function of the file /ThemeAndWidgets.xhtml of the component Theme Customization. Performing a manipulation of the argument uploadLogo results in unrestricted upload. Remote exploitation of the attack is possible. The exploit is now public and may be used. Upgrading to version 6.10 mitigates this issue. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

PUBLISHED Reserved 2026-02-04 | Published 2026-04-01 | Updated 2026-04-01 | Assigner VulDB

MEDIUM: 5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

MEDIUM: 6.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

MEDIUM: 6.3CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

6.5AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C

Problem types

Unrestricted Upload

Improper Access Controls

Product status

6.0
affected

6.1
affected

6.2
affected

6.3
affected

6.4
affected

6.5
affected

6.6
affected

6.7
affected

6.8
affected

6.10
unaffected

Timeline

2026-04-01:	Advisory disclosed
2026-04-01:	VulDB entry created
2026-04-01:	VulDB entry last update

Credits

JustF0rFun (VulDB User) reporter

VulDB coordinator

References

vuldb.com/vuln/354616 (VDB-354616 | Harvard University IQSS Dataverse Theme Customization ThemeAndWidgets.xhtml unrestricted upload) vdb-entry technical-description

vuldb.com/vuln/354616/cti (VDB-354616 | CTI Indicators (IOB, IOC, TTP, IOA)) signature permissions-required

vuldb.com/submit/749003 (Submit #749003 | Harvard University Dataverse Project 6.8 build 1994-92d1ec8 Unrestricted Upload) third-party-advisory

gist.github.com/…iraPeres/ba039887d7f894a7c38252314e0ef2cc exploit

github.com/IQSS/dataverse/releases/tag/v6.10 patch

cve.org (CVE-2026-1879)

nvd.nist.gov (CVE-2026-1879)

Download JSON