Is CVE-2026-48118 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48118 being exploited in the wild.

How severe is CVE-2026-48118?

High severity, with a CVSS score of 8.2, published 13 July 2026.

Which products and versions are affected?

NukeViet < 4.5.09; nukeviet/nukeviet (Packagist) < 4.5.09, ECOSYSTEM:introduced=0,fixed=4.6.00.

Is there a fix for CVE-2026-48118?

Yes. nukeviet/nukeviet (Packagist): upgrade to 4.6.00 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-48118 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-48118?

Check whether you run NukeViet or nukeviet/nukeviet (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48118: NukeViet reflected XSS in Comment Module

Q: Which products and versions are affected?

NukeViet < 4.5.09; nukeviet/nukeviet (Packagist) < 4.5.09, ECOSYSTEM:introduced=0,fixed=4.6.00.

Q: Is there a fix for CVE-2026-48118?

Yes. nukeviet/nukeviet (Packagist): upgrade to 4.6.00 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-48118 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-48118?

Check whether you run NukeViet or nukeviet/nukeviet (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48118 · Severity: high · CVSS 8.2 · Published 2026-07-13

NukeViet, an open-source content management system, contains a vulnerability in its comment module that allows attackers to execute malicious scripts in a user's browser. By tricking a user into clicking a specially crafted link, an attacker could steal login credentials or perform actions on the user's behalf. This is made easier by a secondary flaw where security tokens meant to prevent such attacks are not unique to each user, allowing them to be easily predicted or reused.

Technologies: NukeViet, nukeviet/nukeviet (Packagist). Vendors: NukeViet, Packagist.

Quick answers

Is CVE-2026-48118 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48118 being exploited in the wild.
How severe is CVE-2026-48118?: High severity, with a CVSS score of 8.2, published 13 July 2026.
Which products and versions are affected?: NukeViet < 4.5.09; nukeviet/nukeviet (Packagist) < 4.5.09, ECOSYSTEM:introduced=0,fixed=4.6.00.
Is there a fix for CVE-2026-48118?: Yes. nukeviet/nukeviet (Packagist): upgrade to 4.6.00 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48118 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-48118?: Check whether you run NukeViet or nukeviet/nukeviet (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

nukeviet/nukeviet (Packagist): upgrade to 4.6.00 or later
```
composer require nukeviet/nukeviet:^4.6.00
```

Technical details

The vulnerability consists of two flaws in the NukeViet Comment module. First, the 'status_comment' parameter is sanitized before being base64-decoded, allowing encoded HTML/JavaScript payloads to bypass filters and execute in the victim's browser when rendered unescaped. Second, the 'checkss' anti-forgery token is derived from a site-wide static constant ('NV_CACHE_PREFIX') rather than a per-session value, making it predictable and reusable across different users. An unauthenticated attacker can obtain a valid 'checkss' token from the public HTML and construct a malicious URL that, when visited by a victim, executes arbitrary JavaScript. This can lead to credential theft via phishing overlays or session hijacking. The issue is fixed in version 4.6.00 by binding tokens to user sessions and escaping output before rendering.

Affected products

NukeViet NukeViet < 4.5.09

Identifiers

CVE-2026-48118
GHSA-mxpf-qgg6-v3ff

Timeline

2026-07-13: advisory: GitHub Advisory GHSA-mxpf-qgg6-v3ff published
2026-07-13: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.