CVE-2025-15094: Sunkaifei Flycms XSS Vulnerability

CVE-2025-15094 Overview

CVE-2025-15094 is a reflected Cross-Site Scripting (XSS) vulnerability in sunkaifei FlyCMS, affecting the userLogin function in src/main/java/com/flycms/web/front/UserController.java. The flaw resides in the User Login component, where the redirectUrl parameter is returned to the browser without proper sanitization. An attacker can craft a malicious URL that executes arbitrary JavaScript in the victim's browser when the link is followed. The vulnerability is remotely exploitable and requires user interaction. FlyCMS does not use versioning, so all builds up to commit abbaa5a8daefb146ad4d61027035026b052cb414 are affected. The project has not responded to the disclosure issue filed on GitHub.

Critical Impact
Remote attackers can execute arbitrary JavaScript in a victim's browser session by tricking users into clicking crafted login links, enabling session hijacking, credential theft, and phishing.

Affected Products

sunkaifei FlyCMS (all builds up to commit abbaa5a8daefb146ad4d61027035026b052cb414)
Component: User Login (UserController.java)
Function: userLogin

Discovery Timeline

2025-12-26 - CVE-2025-15094 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-15094

Vulnerability Analysis

The vulnerability is a reflected Cross-Site Scripting flaw [CWE-79] in the FlyCMS User Login handler. The userLogin function in UserController.java accepts a redirectUrl parameter from the HTTP request and reflects the value into the response without HTML-encoding or input validation. When a victim clicks a crafted URL containing JavaScript payloads in redirectUrl, the browser renders the injected script in the security context of the FlyCMS origin.

Because the injection occurs on an authentication-related endpoint, attackers can exfiltrate session cookies, harvest credentials via injected forms, or pivot to further attacks against authenticated users. The exploit has been publicly disclosed, increasing the likelihood of opportunistic abuse. According to the CVE data, the EPSS probability sits around 0.354%, reflecting limited but non-zero real-world exploitation likelihood.

Root Cause

The root cause is missing output encoding and input validation for the redirectUrl request parameter. The parameter, which should be constrained to a safe internal path, is treated as trusted data and echoed into the rendered response. No allow-list check confirms that the URL is a same-origin relative path before rendering.

Attack Vector

Exploitation is network-based and requires the victim to click a specially crafted link, typically delivered via phishing, forum posts, or social media. The attacker embeds a JavaScript payload in the redirectUrl query parameter of the login endpoint. Once opened in the victim's browser, the payload executes with the FlyCMS site's privileges. No authentication is required from the attacker to craft the payload.

The vulnerability manifests when the userLogin handler processes the redirectUrl argument. See the GitHub Issue #16 for FlyCms and VulDB #338423 Details for additional technical context.

Detection Methods for CVE-2025-15094

Indicators of Compromise

HTTP requests to the FlyCMS login endpoint containing redirectUrl values with <script>, javascript:, onerror=, or URL-encoded equivalents (%3Cscript%3E).
Referer headers from external phishing domains linking to the FlyCMS login page with unusual redirectUrl payloads.
Web server access logs showing repeated login requests with abnormally long or encoded redirectUrl query strings.

Detection Strategies

Deploy a Web Application Firewall (WAF) rule to flag or block requests to the login endpoint containing script tags, event handlers, or javascript: schemes in query parameters.
Review application logs for anomalous redirectUrl values that do not match expected internal paths.
Perform periodic dynamic application security testing (DAST) against the FlyCMS login endpoint using XSS payload lists.

Monitoring Recommendations

Alert on outbound requests from user browsers to unfamiliar domains immediately after login page visits, which may indicate cookie exfiltration.
Monitor for Content Security Policy (CSP) violation reports referencing the login page.
Track user reports of unexpected redirects or altered login page behavior.

How to Mitigate CVE-2025-15094

Immediate Actions Required

Restrict public access to the FlyCMS login endpoint via network controls or IP allow-listing where feasible.
Deploy WAF rules that reject redirectUrl values containing HTML metacharacters or non-relative URLs.
Enforce a strict Content Security Policy that disallows inline script execution on the login page.
Educate users to avoid clicking login URLs received from untrusted sources.

Patch Information

No official patch is available. The project has not responded to the GitHub Issue #16 for FlyCms report. Because FlyCMS does not use versioning, administrators should monitor the GitHub Repository for FlyCMS for future remediation commits and apply source-level fixes to UserController.java to HTML-encode the redirectUrl output and validate it against an allow-list of internal paths.

Workarounds

Modify UserController.java to validate that redirectUrl starts with / and contains no protocol or script characters before rendering.
Apply server-side HTML entity encoding to any reflected parameters in login templates.
Configure the web server to set X-XSS-Protection, X-Content-Type-Options: nosniff, and a restrictive CSP header for all responses.
Use HttpOnly and Secure flags on session cookies to reduce the impact of any successful script injection.

bash

# Example WAF rule (ModSecurity) to block XSS payloads in redirectUrl
SecRule ARGS:redirectUrl "@rx (?i)(<script|javascript:|onerror=|onload=|%3Cscript)" \
    "id:1015094,\
    phase:2,\
    deny,\
    status:403,\
    msg:'CVE-2025-15094 FlyCMS redirectUrl XSS attempt blocked'"