EUVD-2026-55624
GHSA-jp3f-93v6-xm3f
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Editor credentials required (PR:L), victim must open image in CMS (UI:R), stored XSS crosses scope boundary into other authenticated user sessions (S:C).
Primary rating from Vendor (CERT-PL).
CVSS VectorVendor: CERT-PL
Lifecycle Timeline
2DescriptionCVE.org
Magnolia CMS is vulnerable to Stored XSS in import functionality. An attacker with editor privileges can inject arbitrary HTML and JS into the name of uploaded image, which will be rendered/executed when opening uploaded image.
The issue was fixed in version 6.3.10
AnalysisAI
Stored XSS in Magnolia CMS's import functionality enables authenticated editors to embed arbitrary JavaScript inside an uploaded image's filename, which executes in the browser of any CMS user who subsequently opens that image. The attack requires low-privileged editor access and passive victim interaction within the CMS backend. No active exploitation has been confirmed (not listed in CISA KEV), no public POC exists, and a vendor-released patch is available in version 6.3.10 as reported by CERT-PL.
Technical ContextAI
Magnolia CMS (CPE: cpe:2.3:a:magnolia_dxp:magnolia_cms) is an enterprise Java-based digital experience platform used for web content management. The import functionality accepts image uploads and stores the user-supplied filename without adequate sanitization. CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS) is the root cause: attacker-controlled input is persisted to the data store and later reflected into a rendered HTML page without output encoding, allowing injected script tags or event handlers in the filename to execute in any victim's browser context when the image is viewed inside the CMS interface. The stored nature of this XSS means the payload persists and can affect multiple victims over time without repeated attacker interaction.
RemediationAI
Upgrade Magnolia CMS to version 6.3.10, the vendor-confirmed fix release documented at https://docs.magnolia-cms.com/product-docs/6.3/releases/release-notes-for-magnolia-cms-6.3.10/. Prior to patching, restrict image import and upload functionality to the smallest possible set of trusted, accountable editor accounts, reducing the pool of principals who could introduce malicious filenames; this may impact content contributor workflows. Additionally, configure Content Security Policy (CSP) headers on the CMS administration interface to block inline script execution, which would mitigate the XSS payload even if triggered - however, CSP implementation in complex CMS environments may require testing to avoid breaking legitimate CMS functionality. Educate CMS administrators not to open uploaded assets from unexpected sources within the backend interface as an interim behavioral control.
More in Magnolia Cms
View allMagnolia CMS v6.2.19 was discovered to contain a cross-site scripting (XSS) vulnerability via the Edit Contact function.
Multiple cross-site scripting (XSS) vulnerabilities in the Magnolia Form module 1.x before 1.4.7 and 2.x before 2.0.2 fo
Magnolia CMS from 6.1.3 to 6.2.3 contains a stored cross-site scripting (XSS) vulnerability in the /magnoliaPublic/trave
Magnolia CMS from 6.1.3 to 6.2.3 contains a stored cross-site scripting (XSS) vulnerability in the setText parameter of
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today