ApostropheCMS CVE-2026-112958

Exploitation requires three concrete conditions, all confirmed by the vendor changeset: (1) the specific project must define a free-form 'string' widget style field rendered inline (no 'selector'), since the vendor states only such projects are affected; (2) the attacker must hold editor permission to edit that widget (PR:L), so this is not anonymous/unauthenticated; and (3) the malicious content must be rendered to a victim - either published content viewed by site visitors or an affected draft viewed by a higher-privileged user (UI:R). The injected quote terminates the inline 'style' attribute and adds executable HTML attributes to the wrapper element. Limiting factors that reduce real-world exposure: non-default configuration (free-form style field must exist), mandatory authentication as a content editor, and dependence on another user rendering the attacker-controlled content.

This is a moderate-severity stored cross-site scripting flaw (CWE-79/CWE-116, CVSS 5.4) that reads as a genuine but not urgent issue. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) is internally consistent with the description: network-reachable, low complexity, but requiring an authenticated low-privileged editor (PR:L) and a victim rendering the content (UI:R), with a scope change (S:C) because editor-controlled input crosses into the rendered page served to other users. No EPSS score, CISA KEV listing, or public POC is present in the provided intelligence - per precision rules this is 'no public exploit identified at time of analysis.' The real-world risk is further constrained because exploitation is only possible when a project defines a free-form style field (the fix changeset explicitly states 'Only projects that define a free-form style field are affected'), making this dependent on a non-default project configuration rather than an out-of-the-box weakness. The limited C:L/I:L and no availability impact reflect typical stored-XSS consequences (session/UI manipulation for the victim) rather than full compromise. Net: a legitimate privilege-escalation-flavored XSS worth patching, but not a widespread mass-exploitation priority given the authentication requirement, configuration dependency, and absence of exploitation signals.

An attacker with low-privileged content-editor access to an ApostropheCMS 4.x site that defines a free-form widget style field enters a value containing a quote character, which prematurely terminates the inline style attribute and injects additional HTML attributes into the rendered wrapper element. When the published content (or an affected draft) is later viewed by another user - including a higher-privileged reviewer - the injected attributes execute in that victim's browser context. No public POC was identified in the provided data.