CVE-2026-75526: django CMS stored XSS in edit-mode plugin exception rendering

CVE-2026-75526 · Severity: medium · CVSS 4.4 · Published 2026-08-20

django CMS is a popular content management system used to build and manage websites. When a plugin fails to render in the editor, the system displays an error message to help content editors debug the issue. A flaw in how this error message is displayed allows editors with plugin-editing permissions to inject malicious code that executes in other staff members' browsers when they view the same content. This could lead to account compromise or unauthorized actions performed on behalf of administrative users.

Technologies: django-cms (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-75526 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-75526 being exploited in the wild.
How severe is CVE-2026-75526?
Medium severity, with a CVSS score of 4.4, published 20 August 2026.
Which products and versions are affected?
django-cms (PyPI) >= 5.0.8, < 5.0.9, ECOSYSTEM:introduced=5.0.8,fixed=5.0.9.
Is there a fix for CVE-2026-75526?
Yes. django-cms (PyPI): upgrade to 5.0.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-75526 attacked?
It is attacked over the network.
Am I affected by CVE-2026-75526?
Check whether you run django-cms (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • django-cms (PyPI): upgrade to 5.0.9 or later
    pip install "django-cms>=5.0.9"

Technical details

The vulnerability is a stored cross-site scripting (XSS) flaw in django CMS's plugin exception rendering path. When a plugin's render() method throws an exception, ContentRenderer.render_exception() constructs a message by concatenating unsanitized values including the exception message, placeholder string representation, placeholder.source, and instance.get_short_description(). This message is embedded directly into an HTML heading and returned via mark_safe(), bypassing Django's template autoescaping. An attacker with staff/plugin-editing privileges can store JavaScript in plugin model fields that feed into get_short_description(), then trigger an exception during edit-mode rendering. The payload executes in the staff editor's browser with their session privileges. The fix applies format_html() to escape the message before inserting it into the heading. The vulnerability requires low privileges (staff access) and user interaction (viewing the error), with attack scope crossing from the vulnerable component to affect other users.

Affected products

  • Django Software Foundation django-cms >= 5.0.8, < 5.0.9

Identifiers

  • CVE-2026-75526
  • GHSA-hvq6-2r72-p2x7
  • PYSEC-2026-3825

Timeline

  • 2026-07-10: disclosed: Vulnerability initially reported
  • 2026-08-20: patched: Fix released in version 5.0.9 using format_html() to escape exception message
  • 2026-08-20: advisory: GitHub Security Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.