CVE-2025-61413: Piranha CMS Stored XSS Vulnerability

CVE-2025-61413 Overview

CVE-2025-61413 is a stored cross-site scripting (XSS) vulnerability in Piranha CMS v12.0. The flaw resides in the /manager/pages component and allows authenticated attackers to inject arbitrary web scripts or HTML through Markdown blocks when creating a page. Once the crafted content is stored, any user rendering the affected page executes the payload in their browser session.

The issue is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation. Piranha CMS is an open-source .NET-based content management framework maintained under the .NET Foundation.

Critical Impact
Attackers with page-authoring privileges can persistently inject JavaScript into Piranha CMS pages, enabling session hijacking, credential theft, and administrative account takeover through cross-site scripting.

Affected Products

Piranha CMS 12.0
Deployments using the /manager/pages administrative interface
Installations that permit Markdown block content creation

Discovery Timeline

2025-10-23 - CVE-2025-61413 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-61413

Vulnerability Analysis

The vulnerability exists in the Markdown block handling within the /manager/pages component of Piranha CMS v12.0. An authenticated user with page creation privileges can submit a Markdown block containing HTML or script payloads. The application stores the payload without adequate neutralization and later renders it when the page is displayed.

Because Markdown parsers commonly permit raw HTML pass-through, script tags and event handlers can survive serialization. When a browser loads the page, the injected script executes within the origin of the Piranha CMS instance. This grants the attacker access to cookies, session tokens, and any Document Object Model (DOM) state available to the victim.

The impact escalates when an administrator views the malicious page. The attacker can invoke administrative endpoints in the victim's context, modify site content, create new administrator accounts, or exfiltrate configuration data.

Root Cause

The root cause is missing or insufficient output encoding of Markdown block content rendered by the page manager. User-supplied Markdown is stored verbatim and rendered without stripping executable HTML constructs such as <script> tags, javascript: URIs, or DOM event attributes like onerror and onload.

Attack Vector

Exploitation requires network access to the Piranha CMS management interface and an account with permission to create or edit pages. User interaction is required — a victim must load the poisoned page. Because the payload is stored, it persists across sessions and affects every subsequent viewer.

A typical attack sequence involves the adversary authenticating to /manager/pages, creating or editing a page, inserting a Markdown block containing a crafted HTML element with a script payload, and publishing the page. Refer to the GitHub advisory for CVE-2025-61413 for proof-of-concept payload details.

Detection Methods for CVE-2025-61413

Indicators of Compromise

Piranha CMS page records containing <script>, onerror=, onload=, or javascript: substrings in Markdown block fields.
Unexpected outbound HTTP requests from browsers rendering CMS pages to attacker-controlled domains.
New or modified administrative accounts in Piranha CMS created shortly after a manager user viewed a page.
Anomalous session cookie usage originating from IP addresses that never authenticated interactively.

Detection Strategies

Query the Piranha CMS database for stored Markdown blocks and flag entries containing HTML tags or JavaScript URI schemes.
Deploy a web application firewall (WAF) rule that inspects POST and PUT requests to /manager/pages for script payloads.
Enable Content Security Policy (CSP) violation reporting to surface inline script execution attempts on rendered pages.

Monitoring Recommendations

Log and review all authenticated actions against /manager/pages, including the identity performing page edits.
Alert on privilege changes, new administrator creation, and role modifications within Piranha CMS immediately after page rendering events.
Monitor browser telemetry for CSP violations and unusual DOM script execution on CMS-hosted pages.

How to Mitigate CVE-2025-61413

Immediate Actions Required

Restrict /manager/pages access to trusted authors and require multi-factor authentication for all manager accounts.
Audit existing pages and Markdown blocks for injected HTML or script content and remove any malicious entries.
Rotate session secrets and force reauthentication for administrative users if suspicious content is discovered.
Track updates from the Piranha CMS GitHub repository for a security release addressing this issue.

Patch Information

At the time of publication, no vendor advisory URL is available in the NVD record. Monitor the Piranha CMS official site and the project's GitHub repository for a fixed release beyond v12.0. Apply the patched version as soon as it is published.

Workarounds

Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Limit page-authoring privileges to a minimal set of vetted administrators until a patch is applied.
Configure the Markdown pipeline to disable raw HTML rendering where the CMS or a reverse proxy allows such filtering.
Sanitize stored Markdown output using a server-side HTML sanitizer before rendering to end users.

bash

# Example Content Security Policy header to mitigate stored XSS execution
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'";