Description

CamaleonCMS contains a stored cross-site scripting vulnerability that allows authenticated low-privileged users to execute arbitrary JavaScript in an administrator's browser by injecting unsanitized HTML payloads into the post title parameter during draft creation. Attackers can submit a malicious HTML payload as a draft title through the drafts creation endpoint, which is persisted to the database without escaping and later rendered as raw HTML in the admin drafts listing, enabling administrator session compromise, cookie theft, and forged authenticated requests.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.7",
  "pubDate": "2026-08-12T20:17:55.053Z",
  "pubdate": "2026-08-12T20:17:55.053Z",
  "executiveSummary": "CamaleonCMS contains a stored cross-site scripting (XSS) vulnerability that allows authenticated low-privileged users to execute arbitrary JavaScript within an administrator's browser context. The vulnerability stems from the application's failure to properly sanitize unsanitized HTML payloads injected into the post title parameter during the draft creation process. These malicious payloads are persistently stored directly within the underlying database without proper contextual output encoding or sanitization.\nWhen an administrative user accesses the admin drafts listing interface, the raw, unescaped HTML payload is rendered directly within the DOM. This enables successful exploitation vectors including administrator session hijacking, sensitive cookie exfiltration, and the execution of unauthorized, forged administrative actions on behalf of the victim. Successful exploitation requires authentication as a low-privileged user capable of creating drafts, alongside social engineering or standard administrative interaction with the vulnerable drafts listing page to trigger the execution of the injected payload.",
  "technicalDetails": "The vulnerability resides within the post management and draft creation endpoint of CamaleonCMS, specifically affecting how user-supplied input provided via the post title parameter is handled, persisted, and subsequently rendered. The root cause of the vulnerability is the absence of adequate input sanitization and output encoding mechanisms prior to database insertion and DOM rendering.\nThe attack flow proceeds as follows: First, an authenticated attacker possessing low-level privileges interacts with the drafts creation endpoint. The attacker submits a crafted HTTP request containing a malicious HTML and JavaScript payload embedded within the post title parameter. Second, the application accepts the input and persists the payload directly to the database without applying any structural sanitization or escaping routines. Third, the vulnerability is triggered when an administrator navigates to the admin drafts listing interface. The application retrieves the stored record and renders the post title as raw HTML within the administrative dashboard.\nBecause the payload is rendered without proper output encoding, the browser interprets the injected strings as executable script elements within the trust context of the administrative session. This permits post-exploitation behaviors such as the extraction of session identifiers, theft of authentication cookies, and the programmatic generation of forged requests to create secondary administrative accounts or modify system configurations. The affected component is the drafts rendering module within the administrative interface. Exploitation requires authenticated access with low privileges, network exposure to the application interface, and interaction from a higher-privileged administrative user viewing the rendered listing."
}