What is the CVSS score of CVE-2026-38949?

CVE-2026-38949 has a CVSS 3.1 base score of 8.9 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of HTMLy are affected by CVE-2026-38949?

HTMLy 3.1.1 contains a stored cross-site scripting vulnerability in the image upload function that allows authenticated content creators to inject malicious scripts affecting all users who view that…

How to fix or mitigate CVE-2026-38949?

Within 24 hours: Disable or restrict image upload functionality in HTMLy 3.1.1 to administrators only; audit existing image uploads for malicious payloads using content security policy logs. Within 7 days: Implement strict input validation and HTML sanitization on all image upload endpoints; require security review of all content created by users with upload privileges in the past 90 days. Within 30 days: Upgrade to HTMLy 3.2.0 or later once vendor patch is released; conduct security awareness training on upload privilege assignment and social engineering risks targeting content creators.

HTMLy CVE-2026-38949

EUVD-2026-26069 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-04-28 mitre

XSS RCE N A

8.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.9 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

May 10, 2026 - 20:22 vuln.today

CVSS changed

May 10, 2026 - 20:22 NVD

8.9 (HIGH)

EUVD ID Assigned

Apr 28, 2026 - 18:45 euvd

EUVD-2026-26069

CVE Published

Apr 28, 2026 - 00:00 nvd

N/A

CVE Published

Apr 28, 2026 - 00:00 nvd

HIGH 8.9

DescriptionCVE.org

Cross-Site Scripting (XSS) vulnerability exists in HTMLy version 3.1.1 in the content creation functionality at the /add/content?type=image endpoint. The application fails to properly sanitize user input, allowing injection of arbitrary code

AnalysisAI

Stored Cross-Site Scripting in HTMLy 3.1.1 allows authenticated users with content creation privileges to inject malicious JavaScript via the image upload endpoint (/add/content?type=image), executing arbitrary code in victim browsers with scope change (S:C) indicating potential account takeover or session hijacking. Public proof-of-concept exists (YouTube demonstration and GitHub writeup), though EPSS score remains low (2%, 4th percentile) and no active exploitation has been confirmed by CISA KEV. CVSS 8.9 reflects high confidentiality and integrity impact but requires victim interaction.

Technical ContextAI

HTMLy is a flat-file CMS/blog platform written in PHP. This vulnerability affects the content creation module specifically at the image upload functionality. The application implements CWE-79 (Cross-Site Scripting) by failing to apply proper output encoding or input sanitization when processing user-supplied data through the /add/content?type=image endpoint. The CVSS scope change (S:C) indicates the vulnerability can affect resources beyond the vulnerable component's security scope, suggesting the injected script executes in contexts that impact other users or sessions. The attack requires low privileges (PR:L), indicating authenticated access to content creation features, and user interaction (UI:R), meaning a victim must view the malicious content. CPE data is incomplete (cpe:2.3:a:n/a:n/a), but EUVD and references confirm HTMLy version 3.1.1 as affected.

RemediationAI

Upgrade to a patched version of HTMLy if available from the official GitHub repository (https://github.com/danpros/htmly). At time of analysis, no vendor security advisory or specific patch version has been identified in the provided data. Users should monitor the HTMLy GitHub repository for security updates addressing CVE-2026-38949. As interim mitigation, restrict content creation privileges (the /add/content endpoint) to only fully trusted administrators, effectively eliminating the attack vector in environments where untrusted users do not require content creation access - this reduces exploitability but prevents legitimate multi-author use cases. Alternatively, implement Web Application Firewall (WAF) rules to sanitize inputs at the /add/content?type=image endpoint, though this adds infrastructure complexity and may have compatibility impacts with legitimate image uploads. Deploy Content Security Policy (CSP) headers with strict script-src directives to prevent inline script execution, which mitigates XSS impact but may break existing HTMLy features that rely on inline JavaScript. Review the POC methodology at https://github.com/Chittu13/cve-research/blob/main/CVE-2026-38949/README.md to understand specific payload patterns for detection rules.