Executive brief
FoxCMS, a content management system, contains a security flaw in its article management component. An attacker can use this vulnerability to run malicious scripts in the browsers of other users, potentially leading to account takeover or the theft of sensitive session information. This could compromise the integrity of the website and the data of its visitors.
Technical details
A cross-site scripting (XSS) vulnerability exists in FoxCMS version 1.2.6 within the '/index.php/article' endpoint. The vulnerability stems from improper neutralization of user-supplied input during web page generation (CWE-79). An unauthenticated remote attacker can exploit this by tricking a user into visiting a specially crafted URL or viewing malicious content, leading to the execution of arbitrary JavaScript in the context of the victim's browser session. This can result in session hijacking, unauthorized actions on behalf of the user, or full compromise of the user's interaction with the application. A proof-of-concept has been identified, but specific patch details were not provided in the advisory.
Affected products
- FoxCMS FoxCMS 1.2.6
Timeline
- 2025-08-25: disclosed
- 2025-08-25: advisory