CVE-2025-54544: Quick.cms Stored XSS Vulnerability

CVE-2025-54544 Overview

CVE-2025-54544 is a stored Cross-Site Scripting (XSS) vulnerability in Opensolution Quick.CMS affecting the files editor functionality. An authenticated administrator can inject arbitrary HTML and JavaScript through the aDirFilesDescriptions parameter. The injected payload executes in the browser of any user who later views the edited page.

The issue was confirmed in Quick.CMS version 6.8. Other versions were not tested and may also be affected. By default, administrator accounts do not have the ability to add JavaScript to the site, so this vulnerability bypasses an intended security boundary. The vendor was notified but did not respond with details on remediation or the vulnerable version range.

Critical Impact

An admin-authenticated attacker can persist arbitrary JavaScript in Quick.CMS content, enabling session theft, defacement, and client-side attacks against visitors of the affected pages.

Affected Products

• Opensolution Quick.CMS 6.8 (confirmed vulnerable)
• Other Quick.CMS versions (not tested, potentially affected)
• CPE: cpe:2.3:a:opensolution:quick.cms:6.8:*:*:*:*:*:*:*

Discovery Timeline

• 2025-08-28 - CVE-2025-54544 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54544

Vulnerability Analysis

The vulnerability is a stored XSS flaw [CWE-79] in Quick.CMS's file editor. The aDirFilesDescriptions parameter accepts user-supplied content that is written to persistent storage without adequate output encoding. When the affected page is rendered, the browser interprets attacker-controlled HTML and script tags as active content.

Quick.CMS enforces a policy where administrators cannot inject JavaScript into site content by default. The aDirFilesDescriptions handler in the files editor does not honor that restriction. This allows a privileged user to bypass the intended sanitization and store executable payloads.

The stored nature of the flaw makes it more damaging than reflected XSS. Payloads persist across sessions and execute for every visitor of the affected page, including other administrators.

Root Cause

The root cause is insufficient input sanitization and output encoding on the aDirFilesDescriptions parameter. Content submitted through the files editor is stored verbatim and reflected into HTML context without escaping angle brackets, quotes, or event handler attributes. The application also fails to apply the sitewide policy that blocks JavaScript in administrator-supplied content.

Attack Vector

Exploitation requires an authenticated administrator account. The attacker submits a crafted description containing HTML and JavaScript through the file editor's aDirFilesDescriptions field. The malicious content is saved to the site's data store and served to any user who loads the edited page.

Because the vector is network-based and requires user interaction (visiting the page), the payload can target other administrators to steal session cookies, perform actions on their behalf, or pivot to further compromise. See the CERT Poland advisory for context on the disclosure. No verified proof-of-concept code is publicly available; the vulnerability mechanism is described in prose per the advisory.

Detection Methods for CVE-2025-54544

Indicators of Compromise

• Presence of <script> tags, on*= event handlers, or javascript: URIs stored in file description fields within Quick.CMS content.
• Unexpected outbound requests from admin browsers to attacker-controlled domains when viewing edited pages.
• Audit log entries showing description updates via the files editor from unusual accounts, IPs, or times.

Detection Strategies

• Query the Quick.CMS database for description fields containing HTML tags, script elements, or encoded payload markers such as &# sequences.
• Deploy a web application firewall rule that inspects POST parameters named aDirFilesDescriptions for script content and event handler patterns.
• Enable Content Security Policy (CSP) reporting to capture blocked inline scripts on rendered content pages.

Monitoring Recommendations

• Monitor administrator account activity for anomalous edits to file descriptions, especially outside normal working hours.
• Log and alert on HTTP responses that return content matching stored XSS signatures within CMS-rendered pages.
• Review browser telemetry from privileged users for unexpected script execution or DOM modifications on CMS pages.

How to Mitigate CVE-2025-54544

Immediate Actions Required

• Audit all file descriptions stored in Quick.CMS 6.8 installations and remove any content containing HTML or JavaScript.
• Restrict administrative access to trusted personnel only and enforce multi-factor authentication for CMS admin accounts.
• Place the Quick.CMS admin panel behind an IP allowlist or VPN to reduce exposure of the files editor.

Patch Information

As of the last NVD update on 2026-06-17, the vendor has not published a security advisory or confirmed a patched version. The vendor did not respond to disclosure with vulnerable version details. Monitor the OpenSolution website and the CERT Poland advisory for future fixes.

Workarounds

• Implement a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
• Apply server-side or reverse-proxy filtering to strip HTML tags and event handler attributes from the aDirFilesDescriptions parameter.
• Limit the number of accounts with administrator privileges and review role assignments periodically.
• Deploy a WAF rule to block requests to the files editor endpoint containing <script, onerror=, onload=, or javascript: substrings.

# Example CSP header to mitigate stored XSS execution
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"