CordysCRM CVE-2026-10514

Q: What is the CVSS score of CVE-2026-10514?

CVE-2026-10514 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33853 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-06-02 cna@vuldb.com

GHSA-vj33-v6j8-4qw8

XSS Java

1.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

1.9 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 02, 2026 - 00:34 vuln.today

Analysis Generated

Jun 02, 2026 - 00:34 vuln.today

DescriptionCVE.org

A vulnerability has been found in 1Panel-dev CordysCRM up to 1.6.2. This affects an unknown function of the file backend/framework/src/main/java/cn/cordys/config/RequestParamTrimConfig.java. The manipulation leads to cross site scripting. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. Upgrading to version 1.7.0 mitigates this issue. The identifier of the patch is c87682afa8df79853299f75489c9d333f7bc5fce. It is suggested to upgrade the affected component.

AnalysisAI

Cross-site scripting in 1Panel-dev CordysCRM versions up to 1.6.2 allows a high-privileged authenticated attacker to inject unescaped HTML payloads through request parameters processed by the Jackson string deserializer in RequestParamTrimConfig.java. The root cause is a global XSS escape toggle (xss.escape.all.enabled) that was disabled by default, meaning all incoming string parameters were returned without HTML sanitization. Publicly available exploit code exists (CVSS E:P, confirmed by VulDB disclosure), though the vulnerability has not been listed in CISA KEV and real-world impact is constrained by the high privilege requirement and passive user interaction dependency.

Technical ContextAI

The vulnerability resides in CordysCRM's Spring Boot backend, specifically in backend/framework/src/main/java/cn/cordys/config/RequestParamTrimConfig.java. This configuration class registers a custom Jackson StdScalarDeserializer for String types, applied globally to all JSON request parameter deserialization. The flaw (CWE-79: Improper Neutralization of Input During Web Page Generation) stems from a configuration property xss.escape.all.enabled defaulting to false, which caused the deserializer to return trimmed-but-unescaped strings - allowing characters such as <, >, ", and & to pass through unmodified into application output. The commit diff confirms the fix replaced this blunt global toggle with a URL-allowlist mechanism using Spring's AntPathMatcher: the new xss.protection.url.list property accepts comma-separated Ant-style path patterns (e.g., /account/follow/**, /announcement/add), and HTML escaping via HtmlUtils.htmlEscape() is applied only when the current request URI matches a configured pattern. The affected product is a Java CRM application maintained by the 1Panel-dev organization on GitHub.

RemediationAI

Upgrade to CordysCRM version 1.7.0, which is the vendor-released patch for this issue. The fix is delivered via commit c87682afa8df79853299f75489c9d333f7bc5fce (https://github.com/1Panel-dev/CordysCRM/commit/c87682afa8df79853299f75489c9d333f7bc5fce) and the release is tagged at https://github.com/1Panel-dev/CordysCRM/releases/tag/v1.7.0. If immediate upgrade is not feasible, a compensating control is to set xss.escape.all.enabled=true in the application's commons.properties or cordys-crm.properties configuration to enable the legacy global HTML escaping path - note that the original configuration comments warn this may break display of legitimate content containing HTML characters such as <, >, and &, so verify rendering of rich-text fields before deploying this workaround. Alternatively, restricting access to CordysCRM to a minimal set of fully trusted high-privilege accounts reduces the attacker pool, since PR:H is a hard prerequisite for exploitation.