Description

Cross Site Scripting vulnerability in Cockpit CMS v.2.13.5 and before allows a remote attacker to execute arbitrary code via the item.php, field-select.js and tags.js components.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-26T21:16:38.217Z",
  "pubdate": "2026-08-26T21:16:38.217Z",
  "executiveSummary": "Cockpit CMS versions 2.13.5 and earlier are affected by a Cross-Site Scripting (XSS) vulnerability. This security flaw allows a remote, unauthenticated or authenticated attacker to inject malicious scripts into the application environment.\nThe vulnerability manifests within specific components, including item.php, field-select.js, and tags.js, enabling the execution of arbitrary JavaScript code within the context of the victim's browser session.\nSuccessful exploitation of this flaw can lead to unauthorized actions performed on behalf of the user, potential session hijacking, data exfiltration, or the unauthorized modification of CMS content.\nThe vulnerability carries significant risk as it compromises the integrity and confidentiality of administrative and user sessions, potentially allowing for full compromise of the application interface if targeted at high-privilege accounts.",
  "technicalDetails": "The vulnerability is identified as a Stored Cross-Site Scripting (XSS) issue originating from the improper sanitization of user-supplied input across multiple components within the Cockpit CMS architecture, specifically item.php, field-select.js, and tags.js.\nThe root cause lies in the application's failure to adequately validate or encode data processed through these scripts before rendering it in the Document Object Model (DOM). By manipulating input fields associated with these components, an attacker can inject malicious script payloads.\nThe attack flow typically involves the attacker supplying a crafted payload as part of a content item or a field selection parameter. When the CMS processes this input via item.php or interacts with the DOM using the vulnerable field-select.js and tags.js files, the payload is persisted to the backend database.\nUpon subsequent access to the affected administrative or public-facing pages, the stored payload is executed within the browser of any user viewing the compromised content. The JavaScript execution occurs within the security context of the Cockpit CMS application, granting the malicious script access to sensitive cookies, session tokens, and the ability to perform background HTTP requests to the CMS API.\nRegarding exploitation requirements, the vulnerability can be leveraged remotely. While the specific authentication context depends on the placement of the vulnerable field, an attacker with sufficient access to create or edit items or tags can trigger this execution. The use of field-select.js and tags.js suggests that client-side scripts are not effectively neutralizing script-based content, allowing the execution of arbitrary code via cross-site vectors.\nPost-exploitation impact is severe, as the attacker can perform arbitrary administrative actions by leveraging the privileges of an authenticated session. This includes, but is not limited to, modifying system configurations, creating new administrative users, or intercepting sensitive data handled by the CMS dashboard. The lack of robust Content Security Policy (CSP) headers or input encoding routines within the specified JavaScript components facilitates this persistent threat, allowing the malicious payload to remain active until manually identified and removed by an administrator."
}