CVE-2025-10940: Total.js CMS XSS Vulnerability

CVE-2025-10940 Overview

CVE-2025-10940 is a stored cross-site scripting (XSS) vulnerability in Total.js CMS version 1.0.0. The flaw resides in the layouts_save function within the /admin/ endpoint, part of the Layout Page component. Attackers can manipulate the HTML argument to inject malicious script content that executes in the browser of any user viewing the affected layout.

The vulnerability requires high privileges and user interaction, limiting its practical impact. However, the vendor did not respond to disclosure attempts, and exploit details have been made public. The issue is categorized under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact

Authenticated administrators can inject persistent JavaScript into CMS layouts, enabling session theft, credential harvesting, or client-side redirection against other CMS users.

Affected Products

• Total.js CMS 1.0.0
• Layout Page component (/admin/ endpoint)
• Deployments exposing the layouts_save function to untrusted administrators

Discovery Timeline

• 2025-09-25 - CVE-2025-10940 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10940

Vulnerability Analysis

The vulnerability affects the layouts_save handler in the Total.js CMS administrative interface. When an authenticated user saves a layout, the CMS accepts the HTML parameter without sufficient sanitization or output encoding. The stored content is subsequently rendered back to browsers when the layout is displayed or previewed.

Because layouts drive the presentation of CMS-rendered pages, injected script content can execute in the context of any user who loads a page relying on the compromised layout. This creates a persistent XSS condition rather than a reflected one, increasing the blast radius across sessions.

Exploitation is possible remotely over the network, but the attacker must first obtain administrative credentials and a target user must interact with the poisoned page. These preconditions constrain real-world impact while still permitting horizontal privilege abuse between administrators or content editors.

Root Cause

The root cause is missing input neutralization on the HTML field processed by layouts_save. The application treats the field as raw markup and persists it verbatim, then reflects it during rendering without contextual output encoding. This pattern maps directly to CWE-79.

Attack Vector

An authenticated attacker submits a crafted POST request to /admin/ targeting the layout save operation. The HTML argument carries JavaScript payloads such as event handlers or <script> tags. Once persisted, any subsequent request that renders the layout delivers the payload to the victim browser, where it runs in the CMS origin and can access session cookies not marked HttpOnly, invoke administrative APIs, or pivot to further attacks.

No verified proof-of-concept code has been published to authoritative repositories. Technical detail is tracked in VulDB entry 325810.

Detection Methods for CVE-2025-10940

Indicators of Compromise

• Layout records in the Total.js CMS datastore containing <script>, onerror=, onload=, or javascript: sequences in the HTML field.
• Unexpected outbound requests from browser sessions of CMS administrators to attacker-controlled domains.
• Administrative audit entries showing layouts_save actions from unusual source IPs or outside change windows.

Detection Strategies

• Inspect stored layout content for HTML event handlers and script tags that were not authored by trusted editors.
• Deploy web application firewall rules that flag script-like tokens in POST bodies sent to /admin/ layout endpoints.
• Correlate administrator login events with layouts_save activity to identify compromised or misused accounts.

Monitoring Recommendations

• Enable verbose access logging on the /admin/ path and forward logs to a centralized analytics platform.
• Monitor Content Security Policy (CSP) violation reports for inline script executions originating from CMS-rendered pages.
• Alert on modifications to layout records outside of scheduled deployment windows.

How to Mitigate CVE-2025-10940

Immediate Actions Required

• Restrict access to the /admin/ interface to trusted networks using IP allowlists or VPN gating.
• Rotate administrative credentials and enforce multi-factor authentication for all CMS operators.
• Audit existing layouts for injected markup and remove any unauthorized HTML content.

Patch Information

No vendor patch is available. The disclosure notes that the vendor did not respond to notification attempts. Operators should track the VulDB advisory for updates and evaluate migration to a maintained fork or alternate CMS if fixes remain unpublished.

Workarounds

• Apply a strict Content Security Policy that disallows inline scripts and restricts script sources to a vetted allowlist.
• Front the CMS with a web application firewall that strips or blocks script tags in layout submissions.
• Reduce the number of administrative accounts and enforce least-privilege role assignments for content editing.

# Example nginx CSP header to reduce XSS impact
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'" always;