Django Cms
Monthly
Stored XSS in django CMS 5.0.8 allows an authenticated editor to execute arbitrary HTML in other staff users' browsers via the edit-mode plugin exception rendering path. When plugin rendering fails in edit mode, ContentRenderer.render_exception in cms/plugin_rendering.py interpolates attacker-controlled values - including get_short_description() output, exception messages, and placeholder source strings - into an HTML heading using an unsafe f-string, then returns the result through mark_safe, bypassing Django's autoescaping. No public exploit has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.
Content exfiltration in django CMS prior to 5.0.9 allows any authenticated staff user holding only page-add permission to read the full plugin content of any page - including restricted, cross-site, and secret pages - by supplying an arbitrary source ID to the page duplication endpoint. The missing object-level authorization check means the only gate (PageAdmin.has_add_permission) verifies only that the user may create pages in general, never that they may access the specific source being copied. Because AddPageForm.save() calls source.copy(..., permissions=False), the resulting duplicate strips view restrictions and becomes readable by anonymous visitors, compounding the confidentiality breach. A detailed proof-of-concept is published in the GHSA advisory; no active exploitation has been confirmed in CISA KEV.
Missing object-level authorization in django CMS's `render_object_structure` endpoint exposes CMS structure metadata of non-PageContent objects to low-privileged staff users. Any active staff account (is_staff=True) can request the `/admin/cms/placeholder/object/<content_type_id>/structure/<object_id>/` endpoint for frontend-editable objects using PlaceholderRelationField, receiving placeholder slot names, plugin trees, plugin identifiers and labels, and object existence - without holding `cms.use_structure` or any model-level view or change permission. No active exploitation confirmed (not in CISA KEV); a working proof-of-concept using the framework's own FancyPoll test model is documented in GHSA-8qj2-c6q4-f399. EPSS data was not provided, but the staff-gated, read-only nature and requirement for ID enumeration limit real-world impact.
Unauthorized content disclosure in django CMS prior to 5.0.8 allows authenticated staff users to exfiltrate plugin content - including secret text, link names, and URLs - from restricted pages and placeholders they are not authorized to access. The vulnerability resides in the copy_plugins admin endpoint (cms/admin/placeholderadmin.py), where the clipboard copy paths validate only the destination (the user's own clipboard) while accepting attacker-controlled source_placeholder_id and source_plugin_id parameters without any source-side authorization check. No active exploitation is confirmed by CISA KEV, but the technical advisory, patch diff, and regression tests are publicly available via GitHub security advisory GHSA-4xfr-4p46-gc6p.
Unauthorized page-content disclosure in django CMS prior to 5.0.8 allows any staff account to retrieve the plugin structure of view-restricted pages by requesting the render_object_structure endpoint, which omits the user_can_view_page() authorization check enforced by the edit and preview endpoints. Exposed data includes plugin short descriptions - link names, target URLs, and text snippets - constituting genuine content disclosure, not merely structural metadata. No public exploit has been identified at time of analysis; exploitation is constrained to authenticated staff users on sites with per-page view restrictions explicitly configured.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in django CMS Association django-cms allows Cross-Site Scripting (XSS).11.7, 3.11.8, 4.1.2,. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cross-site request forgery (CSRF) vulnerability in django CMS before 3.0.14, 3.1.x before 3.1.1 allows remote attackers to manipulate privileged users into performing unknown actions via unspecified. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Stored XSS in django CMS 5.0.8 allows an authenticated editor to execute arbitrary HTML in other staff users' browsers via the edit-mode plugin exception rendering path. When plugin rendering fails in edit mode, ContentRenderer.render_exception in cms/plugin_rendering.py interpolates attacker-controlled values - including get_short_description() output, exception messages, and placeholder source strings - into an HTML heading using an unsafe f-string, then returns the result through mark_safe, bypassing Django's autoescaping. No public exploit has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.
Content exfiltration in django CMS prior to 5.0.9 allows any authenticated staff user holding only page-add permission to read the full plugin content of any page - including restricted, cross-site, and secret pages - by supplying an arbitrary source ID to the page duplication endpoint. The missing object-level authorization check means the only gate (PageAdmin.has_add_permission) verifies only that the user may create pages in general, never that they may access the specific source being copied. Because AddPageForm.save() calls source.copy(..., permissions=False), the resulting duplicate strips view restrictions and becomes readable by anonymous visitors, compounding the confidentiality breach. A detailed proof-of-concept is published in the GHSA advisory; no active exploitation has been confirmed in CISA KEV.
Missing object-level authorization in django CMS's `render_object_structure` endpoint exposes CMS structure metadata of non-PageContent objects to low-privileged staff users. Any active staff account (is_staff=True) can request the `/admin/cms/placeholder/object/<content_type_id>/structure/<object_id>/` endpoint for frontend-editable objects using PlaceholderRelationField, receiving placeholder slot names, plugin trees, plugin identifiers and labels, and object existence - without holding `cms.use_structure` or any model-level view or change permission. No active exploitation confirmed (not in CISA KEV); a working proof-of-concept using the framework's own FancyPoll test model is documented in GHSA-8qj2-c6q4-f399. EPSS data was not provided, but the staff-gated, read-only nature and requirement for ID enumeration limit real-world impact.
Unauthorized content disclosure in django CMS prior to 5.0.8 allows authenticated staff users to exfiltrate plugin content - including secret text, link names, and URLs - from restricted pages and placeholders they are not authorized to access. The vulnerability resides in the copy_plugins admin endpoint (cms/admin/placeholderadmin.py), where the clipboard copy paths validate only the destination (the user's own clipboard) while accepting attacker-controlled source_placeholder_id and source_plugin_id parameters without any source-side authorization check. No active exploitation is confirmed by CISA KEV, but the technical advisory, patch diff, and regression tests are publicly available via GitHub security advisory GHSA-4xfr-4p46-gc6p.
Unauthorized page-content disclosure in django CMS prior to 5.0.8 allows any staff account to retrieve the plugin structure of view-restricted pages by requesting the render_object_structure endpoint, which omits the user_can_view_page() authorization check enforced by the edit and preview endpoints. Exposed data includes plugin short descriptions - link names, target URLs, and text snippets - constituting genuine content disclosure, not merely structural metadata. No public exploit has been identified at time of analysis; exploitation is constrained to authenticated staff users on sites with per-page view restrictions explicitly configured.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in django CMS Association django-cms allows Cross-Site Scripting (XSS).11.7, 3.11.8, 4.1.2,. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cross-site request forgery (CSRF) vulnerability in django CMS before 3.0.14, 3.1.x before 3.1.1 allows remote attackers to manipulate privileged users into performing unknown actions via unspecified. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.