Is there a patch available for EUVD-2026-58571?

Yes, a patch is available for EUVD-2026-58571. Update the affected software to the latest version immediately.

RosarioSIS EUVD-2026-58571

Q: What is the CVSS score of EUVD-2026-58571?

EUVD-2026-58571 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-19786 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-08-14 VulDB

GHSA-3g87-x9p3-8gc7

PHP CSRF Rosariosis Francoisjacquet

5.3

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

Network-reachable CSRF requiring victim interaction (UI:R) and no attacker privileges; limited integrity impact only with no confidentiality or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Aug 14, 2026 - 03:47 vuln.today

Analysis Generated

Aug 14, 2026 - 03:47 vuln.today

CVE Published

Aug 14, 2026 - 02:30 cve.org

MEDIUM 5.3

DescriptionCVE.org

A vulnerability was found in francoisjacquet RosarioSIS up to 12.8. This issue affects some unknown processing of the file Modules.php. Performing a manipulation results in cross-site request forgery. Remote exploitation of the attack is possible. Upgrading to version 12.9 is capable of addressing this issue. The patch is named 801a71272c82cf4bf695fdc5ed42a9b7511d124d. It is recommended to upgrade the affected component.

AnalysisAI

Cross-site request forgery in RosarioSIS up to version 12.8 allows a remote unauthenticated attacker to trigger unintended state-changing actions in Modules.php by luring an authenticated user to a malicious page. The vulnerability stems from the absence of CSRF token validation on the modfunc parameter, compounded by insufficient sanitization of modfunc= in rendered HTML/Markdown output via MarkDownHTML.fnc.php. No public exploit has been identified and the vulnerability is not listed in CISA KEV; the vendor-confirmed patch is available in v12.9.

Technical ContextAI

RosarioSIS is an open-source PHP school information system (CPE: cpe:2.3:a:francoisjacquet:rosariosis:*:*:*:*:*:*:*:*). The root cause is CWE-352 (Cross-Site Request Forgery): Modules.php processes a modfunc GET/POST parameter to dispatch module-level actions without validating that requests originate from within the application. Additionally, the SanitizeMarkDown() and SanitizeHTML() functions in MarkDownHTML.fnc.php did not strip modfunc= from rendered user content, meaning attacker-controlled input could embed functional CSRF links that execute when followed by authenticated users. The commit diff confirms both attack surfaces were addressed in v12.9: Modules.php now checks HTTP_REFERER to strip modfunc on non-AJAX cross-origin requests, and MarkDownHTML.fnc.php now replaces modfunc= with modfunc = (with a space) in sanitized output. The developer explicitly notes in the patch comments that the referer-based check is an incomplete mitigation when HTTP_REFERER is absent due to proxies, rel=noreferrer, or browser privacy configuration.

RemediationAI

Upgrade RosarioSIS to version 12.9, confirmed patched via commit 801a71272c82cf4bf695fdc5ed42a9b7511d124d. The release is available at https://github.com/francoisjacquet/rosariosis/releases/tag/v12.9 and can be applied by overwriting application files or running git pull followed by checkout of the v12.9 tag. Note that v12.9 introduces breaking changes requiring updated companion modules: Reports module 12.1+ (May 2026), NFC/QR Actions module 2.6+ (June 2026), and Parent Agreement plugin 10.5+ (May 2026) - plan these dependency upgrades alongside the core update. If immediate upgrade is not feasible, the most effective compensating control is to ensure SameSite=Strict or SameSite=Lax is configured on session cookies at the web server or PHP session level, which blocks cross-origin cookie submission without application code changes; be aware this may break legitimate cross-site integrations. Additionally, restrict access to Modules.php by IP allowlist or VPN if administrative functions do not require broad internet exposure. Do not rely solely on user education as a compensating control.