CVE-2026-41524
HighSummary
Brave CMS prior to commit 6c56603 stored page and article body content entered by editor-role users through CKEditor verbatim in the database. As a result, any JavaScript or HTML injected by them was permanently stored and executed in every visitor's browser upon page load.
Risk Assessment
The organization is exposed to XSS attacks, which can lead to user data theft or session hijacking. Exploitation of this vulnerability may also harm the organization's reputation.
Recommendation
It is recommended to update Brave CMS to the version containing commit 6c56603 and review and remove any potentially malicious content from the database.
Other vulnerabilities in Brave CMS
See all- CVE-2026-41576High
Brave CMS prior to commit 6c56603 had a publicly accessible contact form, allowing for the injection of unsafe HTML into email content. User-supplied message text was processed by the nl2br() function, which did not sanitize HTML, enabling attackers to create phishing interfaces in emails sent to the administrator.
- CVE-2026-35183High
An IDOR vulnerability in the article image deletion feature in Brave CMS prior to 2.0.6. The deleteImage method in ArticleController.php accepts a filename from the URL without ownership verification, allowing an authenticated user with edit permissions to delete images attached to other users' articles.
- CVE-2026-35182High
In Brave CMS prior to 2.0.6, the update role endpoint lacks authorization checks, allowing any authenticated user to change roles and become Super Admin.
Original NVD description (English source)
Brave CMS is an open-source CMS. Prior to commit 6c56603, page and article body content entered through the CKEditor rich-text editor is stored verbatim in the database and subsequently rendered with Laravel Blade's unescaped output directive {!! !!}. Any JavaScript or HTML injected by an editor-role user is permanently stored and executed in every visitor's browser upon page load. This issue has been patched via commit 6c56603.