CVE-2023-26961: Alteryx Server

Medium severity, CVSS 4.8. EPSS: 0.5% chance of exploitation in the next 30 days.

Alteryx Server 2022.1.1.42590 does not employ file type verification for uploaded files. This vulnerability allows attackers to upload arbitrary files (e.g., JavaScript content for stored XSS) via the type field in a JSON document within a PUT /gallery/api/media request.

Affected products

• Alteryx Alteryx Server: version 2022.1.1.42590 only

Published 2023-08-08. Last modified 2026-07-09.