Executive brief
itranswarp is a full-featured CMS platform built on Spring Boot that supports blogs, wikis, discussions, and other content management features. A vulnerability in the Markdown-to-HTML rendering component fails to properly escape user-supplied content, allowing authenticated contributors and above to inject malicious scripts that execute when other users view the affected pages, potentially compromising user accounts and stealing sensitive information.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the Markdown.toHtml() method (in Markdown.java) used to render article, wiki, and page content. The root cause is that the sysRenderer template helper does not escape HTML output, unlike the safer ugcRenderer, and the template directive uses `content|raw` to output the rendered HTML without filtering. An authenticated user with CONTRIBUTOR privilege or above can inject arbitrary HTML/JavaScript through the article description field; input validation only checks for non-null and length constraints but does not sanitize HTML. The exploit requires authentication and user interaction (viewing the malicious content), but once stored, the payload affects all readers. The project repository was archived on 2026-08-12 and is no longer maintained.
Affected products
- michaelliao itranswarp up to 2.19
Timeline
- 2026-08-12: disclosed: Issue reported on GitHub
- 2026-09-14: advisory: CVE-2026-90835 published on NVD