An authenticated user with upload permission to a hosted repository can store content that causes arbitrary JavaScript to execute in the browser of any user who browse…

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. May 11, 2026 · NIST NVD

   Detected

   An authenticated user with upload permission to a hosted repository can store content that causes arbitrary JavaScript to execute in the browser of any user who browses that repository directory via the HTML index page in Sonatype Nexus Repository versions 3.6.0 through versions before 3.92.0. This could allow the attacker to perform actions in the context of the victim's session.

2. Sep 22, 2026 · NIST NVD

   Updated

   An authenticated user with upload permission to a hosted repository can store content that causes arbitrary JavaScript to execute in the browser of any user who browses that repository directory via the HTML index page in Sonatype Nexus Repository versions 3.6.0 through versions before 3.92.0. This could allow the attacker to perform actions in the context of the victim's session.

Affected

• cpe sonatype/nexus repository managerversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-7308

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-7308

  An authenticated user with upload permission to a hosted repository can store content that causes arbitrary JavaScript to execute in the browser of any user who browses that repository directory via the HTML index page in Sonatype Nexus Repository versions 3.6.0 through versions

  nvd.nist.gov

References

• Release Notes · help.sonatype.com
• Vendor Advisory · support.sonatype.com