Description

A vulnerability was detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Impacted is the function htmlspecialchars_decode of the file App/Home/View/Default/Chapter/oneChapter.tpl of the component Chapter Content Output. Performing a manipulation of the argument content results in cross site scripting. Remote exploitation of the attack is possible. The exploit is now public and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-04T02:17:20.017Z",
  "pubdate": "2026-09-04T02:17:20.017Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists within the Chapter Content Output component of light0011 CMS, specifically affecting the App/Home/View/Default/Chapter/oneChapter.tpl file.\nThe vulnerability stems from improper handling of user-supplied input via the 'content' argument, which is processed by the htmlspecialchars_decode function.\nThis flaw allows remote, unauthenticated attackers to inject and execute arbitrary JavaScript within the context of a victim's browser session.\nSuccessful exploitation results in unauthorized actions on behalf of the user, potential session hijacking, data exfiltration, or the defacement of the affected page.\nGiven that the vulnerability is public and the vendor has not provided a patch, the risk is significant for all deployments of light0011 CMS, which follows a rolling release model.",
  "technicalDetails": "The vulnerability is a reflected or stored Cross-Site Scripting (XSS) flaw located in the Chapter Content Output component of light0011 CMS. The root cause lies in the application's implementation of the htmlspecialchars_decode function within the App/Home/View/Default/Chapter/oneChapter.tpl template file.\nIn typical PHP application development, htmlspecialchars_decode is used to revert HTML entities back to their special characters. When this function is applied to user-controlled input without sufficient preceding validation or subsequent output encoding, it effectively undoes the security measures intended to neutralize malicious scripts.\nThe attack flow begins when an attacker supplies a crafted payload containing HTML tags and JavaScript event handlers (e.g., <script>alert(1)</script> or <img src=x onerror=alert(1)>) into the 'content' argument. When the application processes this input, the htmlspecialchars_decode function decodes any encoded characters, effectively transforming the attacker's string into executable HTML or script content. This payload is then rendered directly into the Document Object Model (DOM) of the user's browser without adequate context-aware sanitization.\nBecause the payload is injected into the view layer, the browser interprets the unsanitized output as active content. Once rendered, the browser executes the injected JavaScript with the privileges of the victim's current session. This allows the attacker to bypass Same-Origin Policy (SOP) restrictions, steal session cookies, capture sensitive information input by the user, or redirect users to malicious domains.\nExploitation does not require prior authentication, making the endpoint remotely accessible. As the project uses a rolling release approach and has not yet addressed the report, the attack surface remains exposed. The vulnerability is categorized as a failure to maintain a secure boundary between data and control plane instructions in the application's rendering logic."
}