CVE-2026-18478CWE-79cross-site-scripting

CVE-2026-18478

published August 10, 2026

CVSS
5.1
EPSS
0%
Percentile
38.9
In the wild
Unconfirmed
What it is

Magnolia CMS is vulnerable to Stored XSS in import functionality. An attacker with editor privileges can inject arbitrary HTML and JS into the name of uploaded image, which will be rendered/executed when opening uploaded image.

The issue was fixed in version 6.3.10

The record
Technical detail
CVSS
5.1 · NONE
CVSS v4.0
Not supplied
EPSS
0.00460 · 38.9th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-08-10T18:17Z
References (3)
https://cert.pl/en/posts/2026/08/CVE-2026-18478 · [email protected]https://docs.magnolia-cms.com/product-docs/6.3/releases/release-notes-for-magnolia-cms-6.3.10/ · [email protected]https://www.magnolia-cms.com/ · [email protected]
EPSS history
Timeline
  • 10 AUG 13:00Z
    Stored XSS in Magnolia CMS
    cvelistv5