HCL Digital Experience OS Command Injection, Host Header Injection, XSS and Multer DoS Vulnerabilities (CVE-2026-21827/21826/21825/2359)

Vulnerability Overview HCL Digital Experience and Digital Experience Compose are potentially affected by multiple vulnerabilities. These include: 1. CVE-2026-21827 - Description: HCL Digital Experience is vulnerable to an OS command injection flaw located in the Digital Asset Management API. An attacker can execute arbitrary operating system commands, typically leveraging the privileges of the vulnerable application, potentially resulting in complete control over the entire system, server, and data. - CVSS Base Score: 9.7 - CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/SC:H/S:C/N:H/I:H/A:H 2. CVE-2026-21826 - Description: HCL Digital Experience and HCL Digital Experience Compose are potentially vulnerable to Host Header Injection. An attacker can manipulate the Host header and cause the application to behave unexpectedly. - CVSS Base Score: 6.1 - CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N 3. CVE-2026-21825 - Description: HCL Digital Experience Compose is affected by a reflected Cross-Site Scripting (XSS) vulnerability located in the Search Center. An attacker can execute arbitrary JavaScript in the victim's browser. - CVSS Base Score: 6.1 - CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N 4. CVE-2026-2359 - Description: A vulnerability exists in versions prior to Multer 2.1.0, allowing an attacker to trigger a Denial of Service (DoS) during file uploads. Users should upgrade to version 2.1.0 to receive the patch. There are currently no known workarounds. Impact Scope HCL Digital Experience and HCL Digital Experience Compose are potentially affected by the aforementioned vulnerabilities. Specific impacts include: - OS Command Injection - Host Header Injection - Reflected Cross-Site Scripting (XSS) - Denial of Service (DoS) Remediation CVE-2026-21827, CVE-2026-21826, CVE-2026-21825: Monitor for patches or updates released by HCL to address these vulnerabilities. CVE-2026-2359: Upgrade to Multer version 2.1.0 or higher. POC Code or Exploit Code No specific POC code or exploit code is provided in the source material.

Goal Reached Thanks to every supporter — we hit 100%!

HCL Digital Experience OS Command Injection, Host Header Injection, XSS and Multer DoS Vulnerabilities (CVE-2026-21827/21826/21825/2359)