OpsTree REMS: Stored cross-site scripting via attachment upload and preview
Summary
OpsTree REMS through version 1.0.0 contains a stored cross-site scripting vulnerability in its attachment upload and preview function. An authenticated user can upload an HTML file with a spoofed text/html Content-Type and a misleading name such as test.html.pdf, which runs JavaScript in the browser of any user who previews it. A successful attack can perform actions in the victim's session, and the risk is higher if an administrator previews the file.
Affected
- OpsTree REMS 0 to 1.0.0 (per the CVE record)
Fixed in
Unknown. No fixed version or vendor advisory was found.
Workaround
- Restrict attachment upload rights to trusted users (third-party suggestion, not confirmed by the vendor).
- Instruct users not to preview unexpected attachments.
- Limit access to REMS to internal networks, VPN or SSO; avoid direct internet exposure.
Exploitation
- No known exploitation in the wild; the CVE is not listed in CISA KEV.
- Public proof of concept: unclear. The reporter's gist is listed as an exploit reference, but this could not be verified.
Our recommendation
- Confirm whether REMS is in use in your environment.
- Restrict who can log in to REMS and who can upload attachments.
- Ask OpsTree for the fixed version and update as soon as a patched release is available.
- Check that uploaded files are not served from the REMS origin and monitor for unexpected attachment activity.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-126771 www.cve.org
- VulnCheck advisory: OpsTree REMS stored XSS www.vulncheck.com
- Reporter's gist (REMS-CVE-6) gist.github.com
- OpsTree REMS product page opstree.com
- VulDB entry 435938 vuldb.com
- OffSeq threat radar entry radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 20:48.
Original description (NVD)
OpsTree REMS through 1.0.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject scripts by uploading attachments with spoofed text/html Content-Type. Attackers can upload HTML files named like test.html.pdf that render in the REMS origin via Preview, executing JavaScript in victims' browsers.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.