Executive brief
Piranha CMS, a content management system used to build and manage websites, contains a security flaw in its page settings module. An attacker with the ability to edit pages can inject malicious scripts into the 'Excerpt' field, which will then execute in the browsers of other users or visitors who view that page. This could lead to unauthorized actions being performed on behalf of users or the theft of sensitive session information.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Piranha CMS v12.1 within the Page Settings module. The vulnerability is caused by improper sanitization of user-supplied input in the 'Excerpt' field when creating or editing pages. An authenticated attacker can inject a malicious JavaScript payload into this field, which is then stored in the database. The payload executes in the context of any user's browser when the affected page is previewed in the manager interface or accessed publicly on the frontend. This allows for session hijacking, unauthorized API calls, or defacement of the site content.
Affected products
- Piranha CMS Piranha CMS 12.1
Timeline
- 2025-12-22: advisory: Initial disclosure and NVD publication
- 2025-12-22: disclosed: Public PoC released on GitHub