What is the CVSS score of CVE-2026-41147?

CVE-2026-41147 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of NukeViet CMS are affected by CVE-2026-41147?

NukeViet CMS versions up to 4.5.07 contain a stored XSS vulnerability that allows unauthenticated attackers to inject malicious scripts affecting any administrative user who views compromised…. A patch is available.

How to fix or mitigate CVE-2026-41147?

Within 24 hours: Identify all NukeViet CMS instances and document current versions. Within 7 days: Apply vendor-released patch to upgrade all affected instances from version 4.5.07 or earlier to the patched version (verify exact version in vendor advisory). Within 30 days: Conduct security audit of all user-submitted content modules, implement content security policy (CSP) headers, and perform penetration testing to validate remediation.

NukeViet CMS CVE-2026-41147

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-05-15 https://github.com/nukeviet/nukeviet

GHSA-64rr-pp78-62ww

XSS PHP

8.7

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.7 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

May 15, 2026 - 17:15 vuln.today

Analysis Generated

May 15, 2026 - 17:15 vuln.today

DescriptionGitHub Advisory

Impact

NukeViet CMS <= 4.5.08 contains a Stored Cross-Site Scripting (XSS) vulnerability caused by insufficient server-side input sanitization in the Request class. The application relies primarily on client-side filtering to sanitize HTML tags and attributes in user-submitted content, which can be bypassed by intercepting and modifying HTTP requests directly (e.g., using Burp Suite).

This affects any module or functionality that accepts user HTML input through the Request class. An attacker can inject malicious payloads such as <iframe srcdoc="<img src=1 onerror=alert(document.cookie)>"></iframe>, which are stored server-side and executed in the browser of any user who views the content.

Who is impacted:

Administrators and moderators who view user-submitted content (e.g., contact messages, comments, or any module using the Request class for HTML input).
The Contact module was used as a proof of concept, but the vulnerability is not limited to this module.
No authentication is required to exploit this vulnerability, making it accessible to any anonymous visitor.

Potential impact includes:

Session hijacking via cookie theft (for non-HttpOnly cookies)
Performing actions on the application under the victim's identity
Defacement or redirection to phishing pages
Phishing attacks via manipulated email notifications

Patches

This vulnerability has been fixed in NukeViet 4.5.08. Users should upgrade to version >= 4.5.08.

Workarounds

Implement server-side HTML sanitization in the Request class to strip or encode dangerous tags and attributes (e.g., <iframe>, srcdoc, event handlers such as onerror, onload).
Apply a Content Security Policy (CSP) header to restrict inline script execution.
Ensure cookies are set with the HttpOnly flag to mitigate cookie theft via XSS.

Resources

Affected source: https://github.com/nukeviet/nukeviet/blob/nukeviet4.5/modules/contact/funcs/main.php
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html

AnalysisAI

Stored Cross-Site Scripting (XSS) in NukeViet CMS versions up to 4.5.07 allows unauthenticated attackers to inject malicious HTML/JavaScript through any module using the Request class for HTML input. The vulnerability stems from insufficient server-side sanitization that relies on client-side filtering, which attackers can bypass using proxy tools like Burp Suite. While not currently listed in CISA KEV and lacking public exploit code, the issue poses significant risk as it requires no authentication and affects administrative users viewing user-submitted content.

Technical ContextAI

NukeViet CMS is a PHP-based content management system distributed via Composer (pkg:composer/nukeviet_nukeviet). The vulnerability exists in the Core/Request.php class which handles user input sanitization. The root cause, classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), occurs because the application performs HTML filtering on the client side, which can be bypassed. The specific weakness involves the srcdoc attribute of iframe elements, which can contain nested HTML with dangerous event handlers like onerror, creating a recursive XSS vector that the original filtering logic failed to address.

RemediationAI

Vendor-released patch: upgrade to NukeViet CMS version 4.5.08 or later, which implements recursive HTML content filtering for attributes like srcdoc. The fix is available via GitHub commit 2a0860fbe22e2f6a3b90f802bf80b25e18699611. For systems that cannot immediately upgrade, implement server-side HTML sanitization to strip iframe tags and srcdoc attributes, deploy Content Security Policy headers to block inline script execution (may break legitimate functionality), and ensure all cookies use the HttpOnly flag to prevent theft via XSS. Each workaround has limitations: CSP may break existing features, and manual sanitization requires careful implementation to avoid bypasses.