Executive brief
Subrion CMS is a web content management system used to build and manage websites. A stored XSS vulnerability in the admin panel's Blocks management feature allows an authenticated administrator to inject malicious code that will execute for other users viewing the website. This could lead to session hijacking, credential theft, malware distribution, or website defacement for all site visitors.
Technical details
The vulnerability is a stored cross-site scripting (CWE-79) flaw in the Blocks endpoint of Subrion CMS. The CSS class name field fails to properly validate and sanitize user input before storing it in the database. An authenticated attacker with administrative privileges (Privileges Required: High) can inject arbitrary HTML and JavaScript into this field via the admin dashboard. The malicious payload is stored server-side and automatically executed in the browsers of any user accessing pages that render the block, without requiring user interaction beyond normal site browsing. No patch has been released as the vendor did not respond to early disclosure. The exploit has been publicly disclosed with proof-of-concept documentation available.
Affected products
- Intelliants Subrion CMS <= 4.0.3
Timeline
- 2026-06-15: disclosed: Vulnerability published to GitHub Advisory Database and NVD
- 2026-08-25: advisory: GitHub Security Advisory review completed