# CVE-2026-44701: OpenSTAManager HTML injection in group name

Source: https://junglewise.ai/threats/cve-2026-44701-openstamanager-html-injection-in-group-name  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-26. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-44701 · Severity: low · CVSS 3.5 · Published 2026-08-26

OpenSTAManager is a business management application that manages users and groups. An attacker with user creation privileges can inject malicious HTML into a group name field, which is then rendered without sanitization in the user interface. When other users view the injected content or click on malicious links, they may be redirected to attacker-controlled sites or exposed to phishing attacks, potentially compromising credentials or sensitive information.

Technologies: [devcode-it/openstamanager (Packagist)](https://junglewise.ai/threats/technologies/devcode-it-openstamanager). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-44701 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44701 being exploited in the wild.

**How severe is CVE-2026-44701?** Low severity, with a CVSS score of 3.5, published 26 August 2026.

**Which products and versions are affected?** devcode-it/openstamanager (Packagist) <= 2.10.1, ECOSYSTEM:introduced=0,fixed=2.11-beta.

**Is there a fix for CVE-2026-44701?** Yes. devcode-it/openstamanager (Packagist): upgrade to 2.11-beta or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44701 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-44701?** Check whether you run devcode-it/openstamanager (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- devcode-it/openstamanager (Packagist): upgrade to 2.11-beta or later

  ```sh
  composer require devcode-it/openstamanager:^2.11-beta
  ```


## Technical details

This is an HTML injection vulnerability (CWE-79) in the modules/utenti/edit.php file. The vulnerability occurs when user-supplied input in the group name field is passed directly to the getTranslation('title') method and rendered in an HTML context without proper sanitization: `'<span class="text-primary">'.$group->getTranslation('title').'</span>`. An authenticated user with group creation privileges can inject arbitrary HTML elements (such as anchor tags with href attributes pointing to malicious URLs). The injected content is rendered and displayed whenever the group is referenced in the application interface, affecting any user who views pages containing the compromised group. The vulnerability requires high privileges (group creator role) and user interaction (clicking the link), but allows attackers to conduct phishing attacks or redirect users to malicious sites. A patch is available in version 2.11-beta and later.

## Affected products

- devcode-it OpenSTAManager <= 2.10.1

## Identifiers

- CVE-2026-44701
- GHSA-crx4-7mmq-j74j

## Timeline

- 2026-08-26: disclosed
- 2026-08-26: patched: Fixed in version 2.11-beta

## References

- [https://api.github.com/users/ilmercu](https://api.github.com/users/ilmercu)
- [https://github.com/ilmercu](https://github.com/ilmercu)
- [https://api.github.com/users/ilmercu/gists%7B/gist_id%7D](https://api.github.com/users/ilmercu/gists%7B/gist_id%7D)
- [https://api.github.com/users/ilmercu/repos](https://api.github.com/users/ilmercu/repos)
- [https://avatars.githubusercontent.com/u/44944821?v=4](https://avatars.githubusercontent.com/u/44944821?v=4)
- [https://api.github.com/users/ilmercu/events%7B/privacy%7D](https://api.github.com/users/ilmercu/events%7B/privacy%7D)

## Related threats

- [OpenSTAManager arbitrary file upload in module update functionality](https://junglewise.ai/threats/cve-2026-38751-openstamanager-arbitrary-file-upload-in-module-update)
- [devcode-it OpenSTAManager SQL injection in confronta_righe.php](https://junglewise.ai/threats/cve-2026-35470-devcode-it-openstamanager-sql-injection-in-confronta-righe-php)
- [OpenSTAManager: SQL Injection via Aggiornamenti Module](https://junglewise.ai/threats/cve-2026-35168-openstamanager-sql-injection-via-aggiornamenti-module)
- [OpenSTAManager Affected by Remote Code Execution via Insecure Deserialization in OAuth2](https://junglewise.ai/threats/cve-2026-29782-openstamanager-affected-by-remote-code-execution-via-insecure)
- [OpenSTAManager has a Time-Based Blind SQL Injection via `options[stato]` Parameter](https://junglewise.ai/threats/cve-2026-28805-openstamanager-has-a-time-based-blind-sql-injection-via-options)