Is there a patch available for CVE-2026-3317?

Yes, a patch is available for CVE-2026-3317. Update the affected software to the latest version immediately.

Navigate Cms CVE-2026-3317

Q: What is the CVSS score of CVE-2026-3317?

CVE-2026-3317 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-24073 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-21 INCIBE

GHSA-xh63-cv27-942f

XSS Navigate Cms Navigate

5.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Apr 21, 2026 - 11:56 vuln.today

CVSS changed

Apr 21, 2026 - 10:22 NVD

5.1 (MEDIUM)

EUVD ID Assigned

Apr 21, 2026 - 09:45 euvd

EUVD-2026-24073

Analysis Generated

Apr 21, 2026 - 09:45 vuln.today

Patch released

Apr 21, 2026 - 09:45 nvd

Patch available

CVE Published

Apr 21, 2026 - 09:03 nvd

MEDIUM 5.1

DescriptionCVE.org

Reflected Cross-Site Scripting (XSS) vulnerability in Navigate Content Management System. The vulnerability is present in the '/blog' endpoint because user input is not properly sanitized through designed query parameters. This results in unsafe HTML rendering, which could allow a remote attacker to execute JavaScript code in the victim's browser.

AnalysisAI

Reflected cross-site scripting in Navigate CMS allows remote attackers to inject and execute arbitrary JavaScript in victims' browsers via unsanitized query parameters in the /blog endpoint. The vulnerability affects Navigate CMS versions 0 through 2.9.5 and requires user interaction (clicking a malicious link). CVSS 5.1 reflects the limited scope (only session/cookie theft) and mandatory user interaction, though exploitation is straightforward for phishing campaigns.

Technical ContextAI

The vulnerability stems from improper input validation and output encoding in the Navigate CMS web application framework, specifically in the /blog endpoint's query parameter handling (CWE-79: Improper Neutralization of Input During Web Page Generation). Navigate CMS is a content management system; the vulnerable component fails to sanitize user-supplied data before rendering it in HTML responses. This is a classic reflected XSS flaw where attacker-controlled query string values are echoed back to the client and interpreted as HTML/JavaScript by the browser without sanitization, enabling script execution within the security context of the victim's session.

RemediationAI

Upgrade Navigate CMS to version 2.9.6 or later to obtain the vendor-released patch. A patch is confirmed available per the INCIBE-CERT notice (https://www.incibe.es/en/incibe-cert/notices/aviso/reflected-cross-site-scripting-navigate-cms-application). Until patching is feasible, implement input validation and output encoding at the application level by reviewing and correcting the /blog endpoint's query parameter handling; specifically, ensure all user-supplied query parameters are validated against a whitelist of expected values and HTML-encoded before rendering in responses. Additionally, deploy a Web Application Firewall (WAF) configured to detect and block reflected XSS payloads targeting the /blog endpoint (common signatures include script tags, event handlers, and JavaScript protocol schemes). These controls introduce minimal performance overhead but may block legitimate requests containing special characters; testing is required before production deployment.