Executive brief
LightCMS is a content management system used to build and manage websites. A security flaw in its administrative menu component allows attackers to run malicious scripts in a user's web browser. This could lead to unauthorized actions being performed on behalf of an administrator or the theft of sensitive session information if a user is tricked into visiting a malicious link.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in LightCMS v2.0 within the /admin/menus component. The application fails to properly sanitize or encode the 'Referer' HTTP request header before rendering it back into the page source, specifically when interacting with the 'Auto Update Menu' functionality. An attacker can exploit this by crafting a request with a malicious payload in the Referer header and tricking a victim into triggering the request. Successful exploitation allows for arbitrary JavaScript execution in the context of the victim's browser session, which can be used for session hijacking or unauthorized administrative actions. No authentication is required to initiate the attack vector, though it requires user interaction.
Affected products
- LightCMS Project LightCMS 2.0
Timeline
- 2026-01-23: disclosed: Vulnerability reported on GitHub issues
- 2026-03-26: advisory: CVE published to NVD