Quick answers
- Is CVE-2026-38949 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-38949 being exploited in the wild.
- How severe is CVE-2026-38949?
- High severity, with a CVSS score of 8.9, published 28 April 2026.
- Which products and versions are affected?
- Danpros HTMLy 3.1.1.
- Is there a fix for CVE-2026-38949?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-38949 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-38949?
- Check whether you run Danpros HTMLy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in HTMLy version 3.1.1 at the '/add/content?type=image' endpoint. The application fails to sanitize user input in the content field, allowing an authenticated low-privileged user to inject a malicious payload. When an administrator views the crafted post, the JavaScript executes in their session context. The exploit can programmatically retrieve the administrator's CSRF token from the password change page and submit a POST request to modify the administrator's credentials, resulting in a complete account takeover. No official patch is currently noted in the advisory, though the vulnerability is publicly disclosed with a proof-of-concept.
Affected products
- danpros HTMLy 3.1.1
Timeline
- 2026-04-28: disclosed: Initial disclosure and CVE assignment
- 2026-04-28: advisory