CVE-2026-41576
HighSummary
Brave CMS prior to commit 6c56603 had a publicly accessible contact form, allowing for the injection of unsafe HTML into email content. User-supplied message text was processed by the nl2br() function, which did not sanitize HTML, enabling attackers to create phishing interfaces in emails sent to the administrator.
Risk Assessment
The organization may be exposed to phishing attacks that could lead to data theft or compromise of administrator accounts. The injection of unauthorized HTML into emails may also affect the organization's reputation.
Recommendation
It is recommended to update Brave CMS to the version containing commit 6c56603 and to monitor emails for suspicious content. Additionally, implementing further security measures for contact forms is advisable.
Other vulnerabilities in Brave CMS
See all- CVE-2026-41524High
Brave CMS prior to commit 6c56603 stored page and article body content entered by editor-role users through CKEditor verbatim in the database. As a result, any JavaScript or HTML injected by them was permanently stored and executed in every visitor's browser upon page load.
- CVE-2026-35183High
An IDOR vulnerability in the article image deletion feature in Brave CMS prior to 2.0.6. The deleteImage method in ArticleController.php accepts a filename from the URL without ownership verification, allowing an authenticated user with edit permissions to delete images attached to other users' articles.
- CVE-2026-35182High
In Brave CMS prior to 2.0.6, the update role endpoint lacks authorization checks, allowing any authenticated user to change roles and become Super Admin.
Original NVD description (English source)
Brave CMS is an open-source CMS. Prior to commit 6c56603, the contact form is publicly accessible (no authentication required). User-supplied message text is passed through PHP's nl2br() function, which converts newlines to <br> tags but does not escape HTML. The resulting string is then passed to a Blade email template using the unescaped {!! $msg !!} directive. The resulting content is then rendered in a Blade email template using the unescaped {!! $msg !!} directive. Because HTML is not sanitized, arbitrary markup can be injected into the email body. While modern HTML-capable email clients (Gmail or Outlook Web) typically block JavaScript execution, they still render HTML content. This allows attackers to craft convincing phishing interfaces inside the email sent to the administrator. This issue has been patched via commit 6c56603.