CVE-2026-48905

MediumCVSS 6.1

Published: 26/05/2026(UTC)Updated: 20/07/2026(UTC)Translated: 22/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.14%

4th percentile - higher than 4% of all known CVEs

Summary

Lack of input filtering in the HTML filter code leads to an XSS (Cross-Site Scripting) vulnerability. An attacker can inject a malicious script that will be executed in the victim's browser.

Risk Assessment

The risk includes potential session theft, account takeover, or display of fraudulent content, which may compromise the confidentiality and integrity of organizational data.

Recommendation

Immediately update the software to a patched version and implement input validation and sanitization in the HTML filter code.

Other vulnerabilities in HTML filter

CVE-2025-63082Medium
Lack of input filtering leads to an XSS vector in the HTML filter code related to data URLs in img tags.

Original NVD description (English source)

Lack of input filtering leads to an XSS vector in the HTML filter code.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS