Executive brief
Feng Office is a popular web-based project management and document collaboration platform. A cross-site scripting vulnerability in the task title handling allows attackers to inject malicious scripts that execute in users' browsers when viewing tasks, potentially leading to session hijacking, credential theft, or malware distribution. The vulnerability affects the application through improper sanitization of task title data.
Technical details
The vulnerability is a cross-site scripting (XSS) flaw located in the getTitle function within application/views/task/add_task.php. The issue stems from insufficient input validation and output encoding of the og_objects.name parameter, which is used to populate task titles without proper sanitization. The attack is network-accessible and does not require authentication. An attacker can craft a malicious task title containing JavaScript code that will execute in the context of other users' browsers when they access the task. The vendor was notified but did not provide a response or patch.
Affected products
- Fengoffice Feng Office up to 3.11.13.11
Timeline
- 2026-09-13: disclosed