Quick answers
- Is CVE-2026-41147 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-41147 being exploited in the wild.
- How severe is CVE-2026-41147?
- High severity, with a CVSS score of 8.7, published 22 May 2026.
- Which products and versions are affected?
- NukeViet CMS <= 4.5.08; nukeviet/nukeviet (Packagist) <= 4.4.01, ECOSYSTEM:introduced=0,last_affected=4.4.01.
- Is there a fix for CVE-2026-41147?
- A patch was published on 2026-05-15: Fix released in version 4.5.08 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-41147 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-41147?
- Check whether you run NukeViet CMS or nukeviet/nukeviet (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A Stored Cross-Site Scripting (XSS) vulnerability exists in NukeViet CMS versions up to and including 4.5.08. The root cause is insufficient server-side input sanitization within the Request class, which primarily relies on bypassable client-side filtering for HTML tags and attributes. An unauthenticated or low-privileged attacker can intercept and modify HTTP requests to inject malicious payloads (e.g., using iframe srcdoc or event handlers) into modules like Contact or Comments. When an administrator or another user views this stored content, the payload executes, potentially leading to session hijacking via cookie theft or unauthorized actions. The vulnerability has been addressed in version 4.5.08.
Affected products
- NukeViet NukeViet CMS <= 4.5.08
Identifiers
- CVE-2026-41147
- GHSA-64rr-pp78-62ww
Timeline
- 2026-05-15: advisory: GitHub Advisory published
- 2026-05-15: patched: Fix released in version 4.5.08
- 2026-05-22: other: NVD published date