# CVE-2026-41147: NukeViet CMS Stored XSS in Request class

Source: https://junglewise.ai/threats/cve-2026-41147-nukeviet-cms-stored-xss-in-request-class  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-22. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2026-41147 · Severity: high · CVSS 8.7 · Published 2026-05-22

NukeViet CMS, a popular content management system, is vulnerable to a security flaw where malicious code can be permanently stored on the website. An attacker can use this to steal administrator login sessions, redirect visitors to phishing sites, or deface the website. This occurs because the system fails to properly clean user-submitted content before saving it to the database.

Technologies: [NukeViet CMS](https://junglewise.ai/threats/technologies/nukeviet), [nukeviet/nukeviet (Packagist)](https://junglewise.ai/threats/technologies/nukeviet-nukeviet). Vendors: [NukeViet](https://junglewise.ai/threats/vendors/nukeviet), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-41147 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41147 being exploited in the wild.

**How severe is CVE-2026-41147?** High severity, with a CVSS score of 8.7, published 22 May 2026.

**Which products and versions are affected?** NukeViet CMS <= 4.5.08; nukeviet/nukeviet (Packagist) <= 4.4.01, ECOSYSTEM:introduced=0,last_affected=4.4.01.

**Is there a fix for CVE-2026-41147?** A patch was published on 2026-05-15: Fix released in version 4.5.08 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41147 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-41147?** Check whether you run NukeViet CMS or nukeviet/nukeviet (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Stored Cross-Site Scripting (XSS) vulnerability exists in NukeViet CMS versions up to and including 4.5.08. The root cause is insufficient server-side input sanitization within the Request class, which primarily relies on bypassable client-side filtering for HTML tags and attributes. An unauthenticated or low-privileged attacker can intercept and modify HTTP requests to inject malicious payloads (e.g., using iframe srcdoc or event handlers) into modules like Contact or Comments. When an administrator or another user views this stored content, the payload executes, potentially leading to session hijacking via cookie theft or unauthorized actions. The vulnerability has been addressed in version 4.5.08.

## Affected products

- NukeViet NukeViet CMS <= 4.5.08

## Identifiers

- CVE-2026-41147
- GHSA-64rr-pp78-62ww

## Timeline

- 2026-05-15: advisory: GitHub Advisory published
- 2026-05-15: patched: Fix released in version 4.5.08
- 2026-05-22: other: NVD published date

## References

- [https://api.github.com/users/hoaquynhtim99](https://api.github.com/users/hoaquynhtim99)
- [https://github.com/hoaquynhtim99](https://github.com/hoaquynhtim99)
- [https://api.github.com/users/hoaquynhtim99/gists%7B/gist_id%7D](https://api.github.com/users/hoaquynhtim99/gists%7B/gist_id%7D)
- [https://api.github.com/users/hoaquynhtim99/repos](https://api.github.com/users/hoaquynhtim99/repos)
- [https://avatars.githubusercontent.com/u/2421714?v=4](https://avatars.githubusercontent.com/u/2421714?v=4)
- [https://api.github.com/users/hoaquynhtim99/events%7B/privacy%7D](https://api.github.com/users/hoaquynhtim99/events%7B/privacy%7D)

## Related threats

- [NukeViet SSRF via X-Forwarded-Host in server_info_update](https://junglewise.ai/threats/cve-2026-55372-nukeviet-ssrf-via-x-forwarded-host-in-server-info-update)
- [NukeViet path traversal in Edit Comment function](https://junglewise.ai/threats/cve-2026-54065-nukeviet-path-traversal-in-edit-comment-function)
- [NukeViet stored XSS via filter bypass in News module](https://junglewise.ai/threats/cve-2026-54064-nukeviet-stored-xss-via-filter-bypass-in-news-module)
- [NukeViet CMS stored XSS in comment reply component](https://junglewise.ai/threats/cve-2026-49259-nukeviet-cms-stored-xss-in-comment-reply-component)
- [NukeViet reflected XSS in Comment Module](https://junglewise.ai/threats/cve-2026-48118-nukeviet-reflected-xss-in-comment-module)