CVE-2025-56526

MEDIUM

Kotaemon < 0.11.0 - Stored Cross-Site Scripting via PDF Content Rendering

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2025-56526. PoCs published by HanTul.

AI-analyzed exploit summary This repository contains a detailed writeup and proof-of-concept for CVE-2025-56526 and CVE-2025-56527, which involve a stored XSS vulnerability in Kotaemon's PDF rendering and plaintext credential storage in localStorage, enabling credential theft and session hijacking.

Description

Cross site scripting (XSS) vulnerability in Kotaemon 0.11.0 allowing attackers to execute arbitrary code via a crafted PDF.

Exploits (1)

nomisec WRITEUP 1 stars
by HanTul · poc
https://github.com/HanTul/Kotaemon-CVE-2025-56526-56527-disclosure

This repository contains a detailed writeup and proof-of-concept for CVE-2025-56526 and CVE-2025-56527, which involve a stored XSS vulnerability in Kotaemon's PDF rendering and plaintext credential storage in localStorage, enabling credential theft and session hijacking.

Classification
Writeup 100%
Attack Type
Xss
Complexity
Moderate
Reliability
Reliable
Target: Kotaemon <= 0.11.0
Auth required
Prerequisites: Authenticated user with document upload permissions · Malicious PDF with embedded JavaScript payload
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (5)

Core 5

Scores

CVSS v3 6.1
EPSS 0.0035
EPSS Percentile 26.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (1)
cinnamon/kotaemon < 0.11.0
Published Nov 18, 2025
Tracked Since Feb 18, 2026