Executive brief
QianFox FoxCMS, a content management system, contains a security vulnerability in its administrative backend. An attacker with administrative access can inject malicious scripts into tags or hotword groups, which then execute when other users or administrators view those pages. This could lead to unauthorized actions being performed in the context of another user's session or the defacement of administrative pages.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in QianFox FoxCMS up to version 1.2.6. The vulnerability is located in the Administrator Backend within the /Tag/edit file (and related components like Tag Group, Hotword Group, and Custom Hotword). The root cause is a failure to perform server-side input validation and output encoding; while frontend length restrictions exist, they can be bypassed by modifying request parameters. An authenticated attacker with high privileges can submit malicious HTML or JavaScript payloads (e.g., via 'onerror' or 'onfocus' attributes) that are stored in the database and executed when the content is rendered. As of the advisory date, the project has not responded to the issue report.
Affected products
- QianFox FoxCMS up to 1.2.6
Timeline
- 2026-05-27: disclosed: Public disclosure of the vulnerability and exploit details.
- 2026-05-27: advisory: CVE-2026-9608 published.