Loading story…
Magnolia CMS was found to contain a stored cross-site scripting vulnerability, tracked as CVE-2026-18478, that allows an attacker with editor privileges to inject arbitrary HTML and JavaScript through the name of an uploaded image. The payload is stored by the application and executes when the uploaded image is later opened, creating a path for session theft, unauthorized actions, or further compromise within Magnolia DXP environments.
The flaw affects Magnolia CMS 6.3.0 through 6.3.10. CERT Polska said it received the report and coordinated disclosure, crediting Kacper Paluch and Łukasz Sobański for responsible reporting. Magnolia addressed the issue in version 6.3.10, and organizations using affected releases should verify they are running the fixed version and review editor-access workflows where untrusted content can be uploaded.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
On 2026-08-10, CERT Polska published CVE-2026-18478, disclosing a stored XSS vulnerability in Magnolia CMS and noting it had coordinated disclosure. The report credited Kacper Paluch and Łukasz Sobański for responsible disclosure.
Magnolia fixed CVE-2026-18478, a stored cross-site scripting vulnerability in Magnolia CMS affecting versions 6.3.0 through 6.3.10. The flaw allowed an attacker with editor privileges to inject arbitrary HTML and JavaScript into an uploaded image name, which executed when the image was opened.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A vulnerability tracked as **CVE-2026-44990** allows stored cross-site scripting in `sanitize-html` when applications use the library’s default configuration and later render sanitized user content as trusted HTML. The flaw affects versions prior to **2.17.4** and stems from the handling of the disallowed `xmp` element: because `htmlparser2` treats `xmp` as a raw-text tag, attacker-supplied markup inside it is preserved as text during sanitization but can be emitted back as active HTML or JavaScript under the default `disallowedTagsMode: 'discard'` behavior. GitHub’s advisory and the upstream patch say the bypass can let payloads such as `<script>`, `img` event handlers, and `svg`-embedded script content survive filtering and execute in a victim’s browser. The fix in **2.17.4** adds `xmp` to `nonTextTags` so content inside a disallowed `xmp` tag is dropped instead of re-emitted, and regression tests were added to confirm the malicious content is removed. The issue was reported by **Vincenzo Turturro** (`sushi-gif`), and users of affected `sanitize-html` deployments, including those in **ApostropheCMS**, were urged to update immediately.
Jun 29, 2026
CERT Polska disclosed four vulnerabilities in the Bludit content management system, including an unrestricted file upload flaw tracked as **CVE-2026-25099** that can lead to remote code execution, a stored XSS issue in image upload handling (**CVE-2026-25100**), a session fixation weakness that can enable session hijacking (**CVE-2026-25101**), and a separate stored XSS flaw in page creation tracked as **CVE-2026-4420**. The vulnerabilities were reported by researchers Arkadiusz Marta and Yassin Abdelrazek and affect multiple Bludit versions, with **CVE-2026-25099** impacting all releases before `3.18.4`, **CVE-2026-25101** affecting versions before `3.17.2`, **CVE-2026-25100** affecting all versions through `3.18.2`, and **CVE-2026-4420** confirmed in `3.17.2` and `3.18.0`. The XSS flaws can be exploited by authenticated users with content or page creation privileges by injecting malicious JavaScript into uploaded SVG content or article tags, with payloads executing when victims access publicly reachable resources without authentication. CERT Polska said the page-creation XSS could be used to automatically create a new site administrator if the victim has sufficient privileges, while the file upload issue could allow direct server-side compromise through remote code execution. The agency also said vendor coordination was incomplete, noting the vendor stopped responding or did not provide details on remediation and affected version ranges, raising uncertainty over whether some future releases may remain vulnerable.
Jun 29, 2026
**Adobe Commerce** disclosed multiple **stored cross-site scripting (XSS)** vulnerabilities affecting versions `2.4.9-alpha3`, `2.4.8-p3`, `2.4.7-p8`, `2.4.6-p13`, `2.4.5-p15`, `2.4.4-p16`, and earlier. The issues tracked as `CVE-2026-21284`, `CVE-2026-21290`, `CVE-2026-21311`, and `CVE-2026-21361` allow malicious JavaScript to be injected into vulnerable form fields and later executed in a victim’s browser when the affected page is viewed. Adobe indicates the impact can include **session takeover** and high confidentiality and integrity risk. The vulnerabilities differ primarily in the privilege level required to plant the payload, with most requiring a **high-privileged attacker** and at least one (`CVE-2026-21290`) being exploitable by a **low-privileged attacker**. In all cases, exploitation requires **user interaction**, as a victim must browse to the page containing the injected content. A separate write-up about a chained exploit involving `postMessage` misconfiguration, prompt injection, and sandbox escape on an AI assistant platform does not describe the same Adobe Commerce disclosure and should be excluded.
Jun 29, 2026