CVE-2025-10758: Htmly CMS Custom Field XSS Vulnerability

CVE-2025-10758 Overview

CVE-2025-10758 is a cross-site scripting (XSS) vulnerability [CWE-79] affecting htmly versions up to 3.1.0. The flaw resides in the Custom Field Handler component, specifically in the /htmly/admin/field/post endpoint. An authenticated administrator can manipulate the label argument to inject arbitrary script content that executes in the browser context of users who view the affected field. The issue requires high privileges and user interaction to exploit, limiting its practical impact. The vendor was notified before public disclosure but did not respond. Public exploit details have been released, increasing the likelihood of opportunistic abuse against unpatched installations.

Critical Impact
Authenticated attackers with administrative access can inject persistent JavaScript through the custom field label parameter, enabling session hijacking or admin-panel manipulation against other users of the htmly instance.

Affected Products

htmly through version 3.1.0
htmly Custom Field Handler component
Deployments exposing /htmly/admin/field/post to authenticated users

Discovery Timeline

2025-09-21 - CVE-2025-10758 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10758

Vulnerability Analysis

The vulnerability is a stored cross-site scripting issue in htmly's Custom Field Handler. The label parameter submitted to /htmly/admin/field/post is not sanitized or output-encoded before being rendered within administrative views. When a user later loads a page that displays the affected custom field, the injected payload executes in their browser session under the origin of the htmly application.

Exploitation requires an authenticated account with permission to create or modify custom fields, which typically maps to an administrator role. The stored nature of the payload means it persists across sessions and can affect any user who renders the poisoned field. Impact aligns with typical stored XSS scenarios: theft of session cookies, forced administrative actions, or delivery of second-stage payloads to authenticated users. The exploit has been publicly disclosed, so proof-of-concept content is available to attackers scanning for exposed htmly instances.

Root Cause

The root cause is missing input validation and output encoding on the label field within the Custom Field Handler. htmly stores administrator-supplied field metadata and later reflects it into HTML contexts without contextual escaping, allowing arbitrary HTML and JavaScript to be persisted and rendered.

Attack Vector

The attack is delivered over the network against the administrative interface. An attacker with administrator credentials submits a crafted label value containing an HTML or JavaScript payload through the /htmly/admin/field/post endpoint. Execution occurs when another authenticated user loads a page that renders the stored label, satisfying the user-interaction requirement described in the CVSS vector.

Because exploitation requires an authenticated privileged account, the practical risk is highest in multi-administrator deployments or environments where administrator credentials may be compromised through phishing or credential reuse. See the VulDB entry for CVE-2025-10758 and the public XSS report on htmly v3.1.0 for technical specifics.

Detection Methods for CVE-2025-10758

Indicators of Compromise

POST requests to /htmly/admin/field/post containing HTML tags, <script> elements, or JavaScript event handlers within the label parameter.
Custom field labels stored on disk or in htmly content files that include markup such as <img onerror=, <svg, or javascript: URIs.
Unexpected outbound HTTP requests from administrator browser sessions after visiting pages that render custom fields.

Detection Strategies

Inspect web server access logs for POST activity to /htmly/admin/field/post and correlate against known administrator source addresses.
Search htmly's stored configuration and content files for HTML control characters within custom field label values.
Deploy a Content Security Policy (CSP) in report-only mode to surface unexpected inline script execution originating from administrative pages.

Monitoring Recommendations

Alert on administrator account activity outside of expected hours or from unfamiliar IP addresses.
Monitor for anomalous session cookie usage that may indicate hijacking following an XSS payload trigger.
Track file modifications to htmly content directories that introduce raw HTML into label fields.

How to Mitigate CVE-2025-10758

Immediate Actions Required

Restrict access to the /htmly/admin interface using network controls, VPN, or IP allowlisting.
Audit all existing custom field labels for injected HTML or JavaScript and remove suspicious entries.
Enforce multi-factor authentication on all htmly administrator accounts to reduce the risk of credential compromise.

Patch Information

No vendor advisory or patch has been published at the time of writing. The vendor did not respond to disclosure attempts referenced in the VulDB submission for CVE-2025-10758. Track the htmly project for updates beyond version 3.1.0 and apply fixes as soon as they are released.

Workarounds

Limit administrator role assignments to trusted personnel and revoke unnecessary accounts.
Deploy a web application firewall rule that blocks HTML tags and script payloads in POST bodies targeting /htmly/admin/field/post.
Apply a strict Content Security Policy that disallows inline scripts on administrative pages to blunt payload execution.

bash

# Example nginx rule to block script payloads in the label parameter
location /htmly/admin/field/post {
    if ($request_method = POST) {
        set $block 0;
        if ($request_body ~* "label=[^&]*(<script|onerror=|onload=|javascript:)") {
            set $block 1;
        }
        if ($block = 1) { return 403; }
    }
    proxy_pass http://htmly_backend;
}