CVE-2025-2491: Ujcms CMS Cross Site Scripting Vulnerability

CVE-2025-2491 Overview

CVE-2025-2491 is a stored cross-site scripting (XSS) vulnerability in Dromara ujcms 9.7.5, a Java-based content management system. The flaw resides in the update function of /main/java/com/ujcms/cms/ext/web/backendapi/WebFileTemplateController.java, which handles the Edit Template File Page in the backend administrative interface. An authenticated attacker with high privileges can inject malicious script content that executes in the browsers of other backend users. The issue is classified under CWE-79 and has been publicly disclosed through the vendor's GitHub issue tracker and VulDB.

Critical Impact
Authenticated backend users can inject persistent JavaScript payloads through the template editor, enabling session hijacking, administrative action forgery, and pivot attacks against CMS administrators.

Affected Products

Dromara ujcms 9.7.5
Component: WebFileTemplateController.java (Edit Template File Page)
Backend administrative template management functionality

Discovery Timeline

2025-03-18 - CVE-2025-2491 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-2491

Vulnerability Analysis

The vulnerability exists in the template file update handler of the ujcms backend. The update method in WebFileTemplateController.java accepts template content submitted by backend users and persists it without sufficient output encoding or input sanitization. When the stored template content is later rendered in the administrative user interface, embedded HTML and JavaScript execute in the context of the viewing user's browser session.

Exploitation requires network access to the backend and high-privilege credentials capable of editing templates. User interaction is required, since the payload triggers when another user loads the compromised template page. Successful exploitation impacts confidentiality and integrity of the browser session but does not directly compromise the underlying host.

Root Cause

The root cause is missing neutralization of user-supplied input during web page generation, consistent with CWE-79. The update handler treats template content as trusted data and stores it verbatim. The rendering layer subsequently emits the stored content into an HTML context without contextual escaping, allowing script tags and event-handler attributes to execute.

Attack Vector

An authenticated attacker navigates to the Edit Template File Page in the ujcms backend and submits a modified template containing a JavaScript payload through the vulnerable update endpoint. The server persists the payload to the template file. When an administrator or another privileged user opens the same template for viewing or editing, the payload executes in their browser. The attacker can steal session cookies, issue authenticated API requests on behalf of the victim, or deface backend interfaces. Refer to the Dromara ujcms GitHub issue and VulDB entry 299997 for reproduction details.

Detection Methods for CVE-2025-2491

Indicators of Compromise

Template files containing unexpected <script> tags, inline event handlers such as onerror or onload, or references to external JavaScript resources.
Backend audit log entries showing template update operations from accounts that do not typically modify templates.
Outbound HTTP requests from administrator browsers to unfamiliar domains shortly after loading backend template pages.

Detection Strategies

Review the ujcms application audit trail for WebFileTemplateController.update invocations and correlate with the account, source IP, and template path modified.
Perform static scanning of template files on disk for suspicious script content, obfuscated JavaScript, or Base64-encoded payloads.
Monitor web server access logs for POST requests to backend template management endpoints originating from unexpected geographies or automation tools.

Monitoring Recommendations

Enable verbose logging on backend administrative endpoints and forward events to a centralized logging or SIEM platform for correlation.
Alert on new or modified template files that contain HTML script constructs, particularly outside of maintenance windows.
Track backend user session anomalies such as unusual API call patterns, elevated request rates, or unexpected privilege changes.

How to Mitigate CVE-2025-2491

Immediate Actions Required

Restrict backend access to trusted networks using firewall rules, VPN, or reverse proxy allowlists until a patched version is deployed.
Audit privileged ujcms accounts and revoke template-editing permissions from users who do not require them.
Inspect existing template files for injected scripts and restore known-good copies where tampering is suspected.

Patch Information

No fixed version has been published in the NVD entry at the time of writing. Track the Dromara ujcms GitHub issue #14 for vendor remediation status and apply the official patch as soon as it becomes available. Until then, treat all 9.7.5 deployments as vulnerable.

Workarounds

Limit the number of accounts assigned the high-privilege role required to edit templates and enforce multi-factor authentication for those accounts.
Deploy a web application firewall rule that inspects POST bodies to the template update endpoint and blocks payloads containing <script>, javascript:, or common event-handler attributes.
Configure a strict Content Security Policy for the backend administrative interface to reduce the impact of injected scripts.

bash

# Example nginx configuration adding a restrictive CSP header to the ujcms backend
location /backend/ {
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "DENY" always;
    proxy_pass http://ujcms_backend;
}