Executive brief
GEOFlow is an open-source content management and distribution platform. A cross-site scripting (XSS) vulnerability in the search functionality allows remote attackers to inject malicious scripts that execute in users' browsers, potentially compromising user sessions, stealing credentials, or defacing content without requiring authentication.
Technical details
The vulnerability is a reflected cross-site scripting (XSS) flaw in the JSON-LD Theme Handler component, specifically in app/Http/Controllers/Site/HomeController.php. The search parameter is not properly sanitized before being output to the page, allowing an attacker to craft a malicious URL containing JavaScript code. The attack is network-based and requires no authentication; a victim only needs to click a crafted link. An attacker can execute arbitrary JavaScript in the victim's browser context, potentially stealing session cookies or performing actions on their behalf. The vulnerability was patched in version 2.1.1 (commit 67abfd864a15d169a78429f3290c91cb3b93e849), and upgrading is recommended.
Affected products
- yaojingang GEOFlow up to 2.1.0
Timeline
- 2026-08-31: disclosed
- 2026-07-17: patched: Fix merged in commit 67abfd864a15d169a78429f3290c91cb3b93e849; patch available in version 2.1.1