CVE-2026-75529: pandora 0 through 1.12.5

Affected technology

pandora · 0 through 1.12.5
pandora-analysis

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

The source says because Flask determines the response MIME type from the filename when a path is supplied, an attacker could submit a file whose content is recognized by Pandora as a PDF while its filename or extension causes the download endpoint to return it with a different, potentially active MIME type. Source advisory’s CVSS 4.0 assessment (base score 6.9/10) rates confidentiality and integrity impact as low; availability impact as none.