CVE-2026-7308
Low
No strong exploitation signal.
CVSS base
5.4
MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS — probability of exploitation (30 days)
0.4%
31.4th percentile
CISA KEV
Not listed
Weakness / dates
CWE-79
Published 2026-05-11 · modified 2026-09-22
CVSS breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
| Attack Vector | N | Network |
| Attack Complexity | L | Low |
| Privileges Required | L | Low |
| User Interaction | R | Required |
| Scope | C | Changed |
| Confidentiality | L | Low |
| Integrity | L | Low |
| Availability | N | None |
Timeline
- 2026-05-11 — Published (NVD)
- 2026-09-22 — Last modified (NVD)
Description
An authenticated user with upload permission to a hosted repository can store content that causes arbitrary JavaScript to execute in the browser of any user who browses that repository directory via the HTML index page in Sonatype Nexus Repository versions 3.6.0 through versions before 3.92.0. This could allow the attacker to perform actions in the context of the victim's session.