Full Report
DOM-based Cross-site Scripting vulnerability (CVE-2026-40126) has been found in OutSystems Service Center software.
Analysis Summary
# Vulnerability: DOM-based Cross-site Scripting in OutSystems Service Center
## CVE Details
- **CVE ID**: CVE-2026-40126
- **CVSS Score**: Not explicitly provided in source (Estimated: Medium/High)
- **CWE**: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
## Affected Systems
- **Products**: OutSystems Service Center
- **Versions**: All versions prior to 11.41.2
- **Configurations**: Any environment where files can be attached and prepared for upload within the Service Center interface.
## Vulnerability Description
OutSystems Service Center is susceptible to a DOM-based Cross-Site Scripting (XSS) flaw. The vulnerability occurs when the application processes file attachments. Specifically, the software fails to properly neutralize input within filenames. If a malicious user uploads a file with a specially crafted filename containing JavaScript code, that code can be executed within the context of the victim's browser session when the filename is rendered in the Document Object Model (DOM).
## Exploitation
- **Status**: Disclosed via Coordinated Vulnerability Disclosure (CVD); no reports of active exploitation in the wild mentioned.
- **Complexity**: Low
- **Attack Vector**: Network (Web-based)
- **Privileges Required**: Low-privileged attacker
## Impact
- **Confidentiality**: Partial (Ability to steal session cookies or sensitive data rendered in the browser)
- **Integrity**: Partial (Ability to perform unauthorized actions on behalf of the user)
- **Availability**: None
## Remediation
### Patches
- **OutSystems Service Center version 11.41.2** or later contains the official fix for this vulnerability. Users are urged to upgrade to this version immediately.
### Workarounds
- No specific workarounds were provided in the advisory. General XSS mitigation involves sanitizing input and implementing a strong Content Security Policy (CSP), but the primary recommendation is the software update.
## Detection
- **Indicators of Compromise**: Audit logs showing file uploads with unusual characters or script tags (e.g., `<script>`, `onerror`, `onload`) in the filenames.
- **Detection methods**: Security teams can use web application scanners or manual inspection of the "File Upload" components within the Service Center to identify if filenames are being rendered without proper encoding.
## References
- CERT Polska Advisory: hxxps[://]cert[.]pl/en/posts/2026/08/vulnerability-in-outsystems-service-center-software/
- CVE Record: hxxps[://]www[.]cve[.]org/CVERecord?id=CVE-2026-40126
- CWE-79 Detail: hxxps[://]cwe[.]mitre[.]org/data/definitions/79[.]html