Executive brief
PluXml CMS, a lightweight content management system that stores data in XML files, is vulnerable to a security flaw in its file upload system. An attacker with basic user permissions can upload a specially crafted image file that, when viewed by another user or administrator, executes malicious code in their browser. This could allow the attacker to steal session information, perform actions on behalf of other users, or deface parts of the website.
Technical details
A Stored Cross-Site Scripting (XSS) vulnerability exists in PluXml CMS due to improper sanitization of uploaded SVG files. An authenticated attacker can upload an SVG file containing a malicious JavaScript payload. In version 5.8.21, the payload executes when a victim clicks the link associated with the uploaded image; in version 5.9.0-rc7, the payload executes when the file is accessed directly. This vulnerability allows for the execution of arbitrary scripts in the victim's browser, potentially leading to session hijacking or unauthorized administrative actions. While versions 5.8.21 and 5.9.0-rc7 are confirmed vulnerable, other versions may also be affected as the vendor has not provided a definitive fix or version range.
Affected products
- PluXml PluXml CMS 5.8.21, 5.9.0-rc7
Timeline
- 2026-02-27: advisory: Initial disclosure by CERT.PL
- 2026-02-27: disclosed: NVD publication date