What is the CVSS score of CVE-2026-29840?

CVE-2026-29840 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-29840?

Organizations using JiZhiCMS v2.5.6 and before should be aware of moderate risk from CVE-2026-29840, a cross-site scripting vulnerability rated CVSS 5.4.

How to fix or mitigate CVE-2026-29840?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

PHP CVE-2026-29840

EUVD-2026-14905 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-24 mitre

GHSA-ffqv-44jp-mf9x

PHP XSS

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 24, 2026 - 16:00 euvd

EUVD-2026-14905

Analysis Generated

Mar 24, 2026 - 16:00 vuln.today

CVE Published

Mar 24, 2026 - 00:00 nvd

MEDIUM 5.4

DescriptionCVE.org

JiZhiCMS v2.5.6 and before contains a Stored Cross-Site Scripting (XSS) vulnerability in the release function within app/home/c/UserController.php. The application attempts to sanitize input by filtering <script> tags but fails to recursively remove dangerous event handlers in other HTML tags (such as onerror in <img> tags). This allows an authenticated remote attacker to inject arbitrary web script or HTML via the body parameter in a POST request to /user/release.html.

AnalysisAI

JiZhiCMS v2.5.6 and earlier contains a stored cross-site scripting (XSS) vulnerability in the user release function that allows authenticated attackers to inject malicious scripts through improper HTML sanitization. The vulnerability exists because the application filters <script> tags but fails to recursively remove dangerous event handlers (such as onerror) from other HTML elements like <img> tags, enabling persistent XSS attacks. A proof-of-concept has been published on GitHub, and while no CVSS score or EPSS data is currently available, the low barrier to exploitation (authenticated access via POST parameter) and persistent nature of the attack present meaningful risk to affected installations.

Technical ContextAI

The vulnerability resides in the release function within app/home/c/UserController.php in JiZhiCMS, a PHP-based content management system. The root cause is an incomplete input validation and output encoding mechanism classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The application implements a blacklist-based sanitization approach that removes <script> tags from the body parameter but does not recursively or comprehensively strip event handler attributes from other HTML elements. This is a common implementation flaw where developers assume blocking script tags is sufficient, overlooking that event handlers (onerror, onload, onclick, etc.) embedded in benign-looking tags like <img>, <svg>, or <body> can execute arbitrary JavaScript. The POST endpoint /user/release.html processes user-supplied content that is stored in the backend without proper encoding, leading to stored XSS that executes when the content is later rendered to other users.

RemediationAI

Immediate remediation requires upgrading JiZhiCMS to a patched version newer than v2.5.6, once available from the project maintainers. In the interim, implement comprehensive input validation and output encoding by replacing the insufficient blacklist-based sanitization with a whitelist-based HTML sanitization library (such as HTML Purifier for PHP) that recursively strips all dangerous attributes including event handlers. Restrict access to the /user/release.html endpoint to trusted user roles only, implement Content Security Policy (CSP) headers with script-src 'self' to mitigate stored XSS impact, and apply strict output encoding when rendering user-supplied content in HTML context. Monitor server logs for suspicious POST requests to the release endpoint and audit all previously submitted user content for embedded event handlers or obfuscated payloads. Enable HTML sanitization at both input (upon submission) and output (upon rendering) layers as defense-in-depth.