EUVD-2026-25364Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
6DescriptionGitHub Advisory
Xibo is an open source digital signage platform with a web content management system and Windows display player software. A stored Cross-Site Scripting (XSS) vulnerability in versions prior to 4.4.1 allows an authenticated user with notification creation permissions to inject arbitrary JavaScript into the notification body. When the notification is set as an "interrupt," the payload executes automatically in the browser of any targeted user upon login, requiring zero user interaction. Exploitation of the vulnerability is possible on behalf of an authorized user who has both of the following privileges, which are not granted to non-admins as standard: Access to the Notification Centre to view past notifications, and include "Add Notification" button to allow for the creation of new notifications. Users should upgrade to version 4.4.1 which fixes this issue. Upgrading to a fixed version is necessary to remediate. Users unable to upgrade should revoke such privileges from users they do not trust.
AnalysisAI
Stored cross-site scripting in Xibo CMS versions prior to 4.4.1 allows authenticated users with notification creation privileges to inject arbitrary JavaScript into notification bodies that executes automatically in targeted users' browsers upon login without requiring user interaction. This vulnerability affects the notification interrupt feature and requires the attacker to possess both notification centre access and notification creation permissions, which are restricted to administrative roles by default.
Technical ContextAI
Xibo is an open-source digital signage platform comprising a web-based content management system and a Windows display player. The vulnerability exists in the notification subsystem where user-supplied input in the notification body field is stored without proper sanitization or encoding. When a notification is configured as an 'interrupt' type, the stored payload is rendered in the context of authenticated user sessions without content security policy restrictions or output encoding, allowing arbitrary JavaScript execution. This is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and represents a classic stored XSS vulnerability where malicious input persists in the database and is executed server-side on page rendering.
RemediationAI
Upgrade Xibo CMS to version 4.4.1 or later immediately to receive the vendor-released patch that fixes the input sanitization vulnerability. For organizations unable to upgrade immediately, revoke notification creation and notification centre access permissions from any users who are not explicitly required to have these capabilities, particularly non-administrative accounts. This workaround requires careful access auditing to identify privilege creep and may impact notification workflow depending on organizational structure. Additionally, restrict notification interrupt settings to only trusted notification sources and conduct content security audits of existing notifications to identify potential malicious payloads. These compensating controls do not eliminate the vulnerability but reduce exploitation probability by limiting the number of users with dangerous privileges.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today