CVE-2026-75526
MediumCVSS 4.4Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
django CMS from 5.0.8 until 5.0.9 has a vulnerability where ContentRenderer.render_placeholder in cms/plugin_rendering.py can pass stored, attacker-controlled values to ContentRenderer.render_exception when plugin rendering fails in edit mode. Values from get_short_description(), the exception message, the placeholder, or placeholder.source are interpolated into a cms-rendering-exception heading and later returned through mark_safe. Because the heading is not escaped, stored HTML executes in an editor’s browser, and settings.DEBUG does not prevent the custom heading from rendering.
Risk Assessment
An attacker can inject malicious HTML/JavaScript that executes in the editor's browser, potentially leading to session theft, account takeover, or other client-side attacks.
Recommendation
Upgrade django CMS to version 5.0.9 or later, which includes a fix using format_html to escape the message before safe placeholder output is returned.
Other vulnerabilities in django CMS
See all- CVE-2015-5081High
The CSRF vulnerability in django CMS before version 3.0.14 and 3.1.x before 3.1.1 allows remote attackers to manipulate privileged users into performing unknown actions.
- CVE-2026-63003Medium
django CMS prior to 5.0.9 has a vulnerability in page duplication that lacks an object-level authorization check on the source page. In cms/admin/forms.py, DuplicatePageForm.source accepts any Page, the AddPageForm constructor does not narrow a hidden source field, AddPageForm.clean does not validate the source against the user, and AddPageForm.save calls from_source. In cms/admin/pageadmin.py, duplicate and PageAdmin.has_add_permission check only whether a staff user may add a page. A crafted source value can therefore copy every placeholder and plugin from an unauthorized page with permissions=False, stripping source view restrictions and exposing content across sites or restricted subtrees when CMS_PERMISSION is enabled.
- CVE-2026-61663Medium
django CMS prior to 5.0.9 has a vulnerability in render_object_structure that fails to authorize non-PageContent objects that use PlaceholderRelationField. An active staff user without cms.use_structure or model-level view or change permission can request the //admin/cms/placeholder/object/<content_type_id>/structure/<object_id>/ endpoint with guessed content_type_id and object_id values. The response discloses placeholder slot names, plugin trees, plugin identifiers, labels, and object existence for frontend-editable objects. The fix applies user_can_view_placeholder_source to the non-PageContent branch while keeping the structure board read-only for view-only users.
- CVE-2026-54624Medium
django CMS prior to 5.0.8 has a vulnerability in render_object_structure in cms/views.py that renders cms/toolbar/structure.html for a PageContent object without calling user_can_view_page(). Any staff account can request a restricted page’s structure when CMS_PERMISSION is enabled and the page has view restrictions or CMS_PUBLIC_FOR is set to staff. The response exposes plugin get_short_description() values, including link names, URLs, and text snippets, rather than only the page shape.
- CVE-2026-54622Medium
django CMS before version 5.0.8 has a vulnerability in the copy_plugins endpoint that authorizes only the destination clipboard but does not validate the source placeholder. A staff user with global add permission for a plugin type can copy plugins from unauthorized pages and read secret text, link names, and URLs.
- CVE-2026-54625Medium
django CMS before 5.0.8 and 5.1.0 ignores request headers declared by plugins through get_vary_cache_on() when generating cache keys. This causes different users to receive content intended for others.
- CVE-2026-54623High
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the move_plugin endpoint in cms/admin/placeholderadmin.py accepts an attacker-controlled plugin_parent value without rejecting a plugin’s own identifier or a descendant identifier. A staff user with plugin-change permission under CMS_PERMISSION can create a parent_id cycle in the plugin tree. The _get_descendants_cte and _get_ancestors_cte queries in cms/models/pluginmodel.py have no cycle guard, so get_descendants() and later rendering, copy, or delete operations can recurse indefinitely or reach a database recursion limit, corrupting the tree and consuming request workers. This issue is fixed in versions 5.0.8.
Original NVD description (English source)
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. From 5.0.8 until 5.0.9, ContentRenderer.render_placeholder in cms/plugin_rendering.py can pass stored, attacker-controlled values to ContentRenderer.render_exception when plugin rendering fails in edit mode. Values from get_short_description(), the exception message, the placeholder, or placeholder.source are interpolated into a cms-rendering-exception heading and later returned through mark_safe. Because the heading is not escaped, stored HTML executes in an editor’s browser, and settings.DEBUG does not prevent the custom heading from rendering. The fix uses format_html to escape the message before safe placeholder output is returned. This issue is fixed in versions 5.0.9.