Description

Cross Site Scripting vulnerability in Omeka S v.4.2.0 allows a remote attacker to execute arbitrary code via the site navigation custom URL function

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-28T16:17:46.423Z",
  "pubdate": "2026-08-28T16:17:46.423Z",
  "executiveSummary": "Omeka S v.4.2.0 contains a Cross-Site Scripting (XSS) vulnerability within the site navigation custom URL function.\nThis vulnerability allows remote, authenticated attackers to inject malicious scripts into the navigation configuration, which are subsequently executed in the context of other users' browsers.\nSuccessful exploitation compromises the integrity and confidentiality of the affected user sessions, potentially leading to unauthorized actions or data exfiltration.\nThe vulnerability is localized to the administrative interface where navigation menus are managed.\nRisk implications include account takeover, unauthorized administrative actions, and the bypass of security controls via client-side code execution.\nExploitation requires administrative or equivalent privileges capable of modifying site navigation settings.",
  "technicalDetails": "The vulnerability is a stored Cross-Site Scripting (XSS) flaw located in the site navigation management component of Omeka S v.4.2.0. The root cause is the improper sanitization and validation of input provided within the custom URL field of the site navigation interface.\nWhen an administrator or a user with similar privileges inputs a crafted payload into the custom URL field, the application fails to adequately encode or neutralize the malicious characters. Consequently, the input is persisted directly into the database without transformation.\nThe attack flow proceeds as follows: An attacker with access to the navigation configuration interface initiates the creation or modification of a navigation link. Within the URL field, the attacker inserts a JavaScript payload, for instance, an 'onerror' or 'javascript:' URI scheme wrapper. Upon saving the navigation configuration, the application stores this payload server-side.\nWhen any user, including high-privilege administrators or front-end site visitors, accesses the navigation menu where the malicious link is rendered, the application injects the unsanitized payload into the Document Object Model (DOM). The victim's browser interprets the stored string as executable script rather than a simple text-based URL.\nBecause the execution occurs within the victim's browser session, the script operates under the same origin policy of the Omeka S instance. This allows the attacker to execute arbitrary code, steal session cookies (if 'HttpOnly' flags are absent or bypassed), perform unauthorized administrative actions via forged requests, or redirect users to malicious third-party domains.\nThe vulnerable component is identified as the site navigation custom URL handler. Authentication is a prerequisite for exploitation, as the site navigation modification interface is typically protected behind administrative access controls. Once the payload is saved, the exposure is network-wide, as the navigation elements are rendered globally across the application's interface.\nPost-exploitation impact includes persistent client-side code execution, enabling the attacker to maintain a presence within the platform, hijack administrative sessions, or facilitate further attacks against other authenticated users."
}