{"id":"CVE-2026-18478","state":"PUBLISHED","title":"Stored XSS in Magnolia CMS","description":"Magnolia CMS is vulnerable to Stored XSS in import functionality. An attacker with editor privileges can inject arbitrary HTML and JS into the name of uploaded image, which will be rendered/executed when opening uploaded image.\n\n\n\n\nThe issue was fixed in version 6.3.10","publishedAt":"2026-08-10T13:00:16.854Z","updatedAt":"2026-08-10T17:58:41.118Z","severity":{"score":5.1,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","source":"CERT-PL"},"assigner":"CERT-PL","products":["Magnolia DXP Magnolia CMS"],"affected":[{"vendor":"Magnolia DXP","product":"Magnolia CMS","defaultStatus":"unaffected","versions":[{"version":"6.3.0","status":"affected","lessThan":"6.3.10","versionType":"semver"}]}],"references":["https://cert.pl/en/posts/2026/08/CVE-2026-18478","https://docs.magnolia-cms.com/product-docs/6.3/releases/release-notes-for-magnolia-cms-6.3.10/","https://www.magnolia-cms.com/"],"weaknesses":["CWE-79"],"ingestedAt":"2026-10-29T20:11:10.572Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/18xxx/CVE-2026-18478.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-18478","state":"PUBLISHED","datePublished":"2026-08-10T13:00:16.854Z","dateUpdated":"2026-08-10T17:58:41.118Z","assignerShortName":"CERT-PL","assignerOrgId":"4bb8329e-dd38-46c1-aafb-9bf32bcb93c6","dateReserved":"2026-07-31T11:05:25.198Z"},"containers":{"cna":{"title":"Stored XSS in Magnolia CMS","descriptions":[{"lang":"en","value":"Magnolia CMS is vulnerable to Stored XSS in import functionality. An attacker with editor privileges can inject arbitrary HTML and JS into the name of uploaded image, which will be rendered/executed when opening uploaded image.\n\n\n\n\nThe issue was fixed in version 6.3.10"}],"affected":[{"vendor":"Magnolia DXP","product":"Magnolia CMS","defaultStatus":"unaffected","versions":[{"version":"6.3.0","status":"affected","lessThan":"6.3.10","versionType":"semver"}]}],"references":[{"url":"https://cert.pl/en/posts/2026/08/CVE-2026-18478","tags":["third-party-advisory"]},{"url":"https://docs.magnolia-cms.com/product-docs/6.3/releases/release-notes-for-magnolia-cms-6.3.10/","tags":["release-notes"]},{"url":"https://www.magnolia-cms.com/","tags":["product"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","subConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","subIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"MEDIUM","baseScore":5.1,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","lang":"en","description":"CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')","type":"CWE"}]}],"providerMetadata":{"shortName":"CERT-PL","orgId":"4bb8329e-dd38-46c1-aafb-9bf32bcb93c6","dateUpdated":"2026-08-10T13:00:16.854Z"},"impacts":[{"capecId":"CAPEC-592","descriptions":[{"lang":"en","value":"CAPEC-592 Stored XSS"}]}],"credits":[{"lang":"en","value":"Kacper Paluch","type":"finder"},{"lang":"en","value":"Łukasz Sobański","type":"finder"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 1.0.3"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-08-10T17:58:32.344363Z","id":"CVE-2026-18478","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-08-10T17:58:41.118Z"}}]}}}