CVE-2026-11569: Red Hat Quay 3

Medium severity, CVSS 5.4. EPSS: 0.1% chance of exploitation in the next 30 days.

A flaw was found in Quay. The filedrop endpoint accepts any mime type without validation, allowing an authenticated user with repository write access to upload a malicious SVG file containing JavaScript. The file is stored and served inline through the CDN, enabling stored cross-site scripting when a victim visits the archive URL.

Affected products

• Red Hat Red Hat Quay 3

Published 2026-06-08. Last modified 2026-07-23.