Full Report
Stored Cross-Site Scripting vulnerability (CVE-2026-18478) has been found in Magnolia CMS software.
Analysis Summary
# Vulnerability: Stored XSS in Magnolia CMS Import Functionality
## CVE Details
- **CVE ID:** CVE-2026-18478
- **CVSS Score:** Not explicitly provided in the source (Typically 5.4 - 6.5 for Stored XSS requiring privileges)
- **CWE:** CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
## Affected Systems
- **Products:** Magnolia CMS (Magnolia DXP)
- **Versions:** From version 6.3.0 up to (but not including) 6.3.10
- **Configurations:** Systems utilizing the image upload/import functionality within the CMS.
## Vulnerability Description
Magnolia CMS is vulnerable to a Stored Cross-Site Scripting (XSS) flaw within its import functionality. The application fails to properly sanitize or neutralize input provided in the filename of uploaded images. An attacker can embed malicious HTML or JavaScript code into the name of an image file; when this image is subsequently opened or viewed within the CMS interface, the malicious script is executed in the context of the user's browser session.
## Exploitation
- **Status:** Coordinated Disclosure (No reports of exploitation in the wild mentioned)
- **Complexity:** Low
- **Attack Vector:** Network (Web Interface)
- **Required Privileges:** Editor privileges (Authenticated)
## Impact
- **Confidentiality:** Partial (Can lead to session hijacking or theft of sensitive information displayed in the CMS)
- **Integrity:** Partial (Can allow unauthorized modification of CMS content or settings via the victim's session)
- **Availability:** None
## Remediation
### Patches
- **Magnolia CMS version 6.3.10** has been released to address this vulnerability. Users are advised to upgrade to this version or newer immediately.
### Workarounds
- Restrict image upload permissions to highly trusted users only.
- Implement a Web Application Firewall (WAF) to filter common XSS payloads in multipart/form-data uploads.
## Detection
- **Indicators of Compromise:** Review CMS audit logs for image filenames containing suspicious characters such as `<script>`, `onerror=`, or `onload=`.
- **Detection methods and tools:** Automated vulnerability scanners can be used to test the image import/metadata fields for script injection.
## References
- CERT Polska Advisory: [https://cert.pl/en/posts/2026/08/CVE-2026-18478/](https://cert.pl/en/posts/2026/08/CVE-2026-18478/)
- CVE Record: [https://www.cve.org/CVERecord?id=CVE-2026-18478](https://www.cve.org/CVERecord?id=CVE-2026-18478)
- Magnolia Security Information: [https://www.magnolia-cms.com/](https://www.magnolia-cms.com/)