SSCMS EUVD-2026-26417

An attacker must have valid authentication credentials to access the /api/stl/actions/dynamic endpoint (PR:L in CVSS vector). The victim must interact with the malicious payload - either by clicking an attacker-crafted link, submitting a form, or opening a page controlled by the attacker that includes the payload. The vulnerability is exploitable only when the application decrypts and returns user-supplied or attacker-controlled STL templates without proper output encoding. Default SSCMS installations are likely vulnerable if the /api/stl/actions/dynamic endpoint is enabled and no Web Application Firewall (WAF) rules block XSS payloads. The attack does not require special SSCMS configuration, non-default settings, or elevated privileges beyond basic authentication.

CVSS 4.6 (medium) with network vector (AV:N), low complexity (AC:L), and low authentication barrier (PR:L) indicates the vulnerability is accessible to any authenticated user without special configuration. However, the presence of required user interaction (UI:R) significantly reduces exploitability - the victim must click a malicious link or submit a crafted request containing the payload. The attack scope is unchanged (S:U), meaning impact is confined to the victim's session, not system-wide. EPSS data is not provided, limiting probabilistic exploitation estimates. KEV status is not confirmed, so active widespread exploitation cannot be verified. POC availability is indicated by the GitHub issues reference but not explicitly confirmed as public or weaponized. The confluence of factors - authenticated access requirement, UI requirement, and confined scope - suggests this is a real but not critical risk best addressed through standard web security practices (input validation, output encoding). The medium CVSS score is appropriate for a reflected XSS requiring authentication and user interaction.

An authenticated attacker crafts a malicious STL template payload containing JavaScript (e.g., <img src=x onerror=alert('XSS')>) and submits it to the /api/stl/actions/dynamic endpoint. The server decrypts the payload and returns it in a JSON response without encoding. The attacker then tricks a logged-in user into clicking a link containing this payload or submitting a form that includes it. The victim's browser executes the injected JavaScript, which can steal session cookies, redirect to a phishing site, or perform unauthorized actions (like changing account settings) on behalf of the victim.