Apostrophecms CVE-2026-40186

Exploitation requires THREE specific conditions: (1) textarea or option elements must be explicitly included in the allowedTags configuration-this is non-default behavior, though common in form builders and CMS platforms that allow rich form construction; (2) the attacker must have the ability to submit or control input to these elements, typically through a public-facing form or content submission feature; and (3) user interaction is required (UI:R in CVSS vector), meaning the victim must view the rendered output (e.g., navigate to a page containing the injected content or load an email with the payload). Default ApostropheCMS configurations that do not explicitly whitelist textarea or option are NOT affected. The vulnerability does not require authentication (PR:N) and is remotely accessible (AV:N), but the non-default allowedTags requirement and user interaction prerequisite significantly limit real-world impact compared to unauthenticated network RCE.

The CVSS score of 6.1 with network vector (AV:N), low complexity (AC:L), no privilege requirement (PR:N), and required user interaction (UI:R) indicates moderate risk from a network perspective, but the real-world impact is constrained by non-default configuration requirements. The CVSS scope change (S:C) indicates the vulnerability can affect resources beyond the application's security scope, consistent with stored XSS scenarios. The presence of a GitHub security advisory (GHSA-9mrh-v2v3-xpfm) confirms vendor acknowledgment, but no CISA KEV listing or public proof-of-concept code has been identified at time of analysis, suggesting either recent disclosure or limited active exploitation. The attack requires three preconditions: (1) textarea or option must be in the allowedTags configuration (non-default), (2) user must supply input through these elements, and (3) user interaction (UI:R) is required, likely form submission. These conditions significantly reduce real-world exploitability compared to the CVSS score alone. The vulnerability is easily exploitable once conditions are met-entity encoding is trivial to apply-so organizations using form builders or CMS systems with textarea/option in allowedTags should prioritize patching. However, default ApostropheCMS configurations using the standard allowedTags list are unlikely to be affected.

An attacker submits a form on a vulnerable ApostropheCMS site containing a textarea or option element configured in allowedTags. The attacker enters entity-encoded XSS payload such as <script>alert('XSS')</script> into the form field. When the form is submitted and processed by the sanitize-html library, the parser decodes the entities to literal HTML characters, bypassing the allowedTags filter, and the script tag is written to the output and rendered in the browser of any user viewing the content, executing arbitrary JavaScript in the victim's context.