CVE-2025-8116: Widzialni Pad CMS XSS Vulnerability

CVE-2025-8116 Overview

CVE-2025-8116 is a Reflected Cross-Site Scripting (XSS) vulnerability in PAD CMS, a content management system developed by Widzialni. The flaw resides in the printing and save-to-PDF functionality and affects all three shipped templates: www, bip, and www+bip. An attacker can craft a malicious URL that, when opened by a victim, causes arbitrary JavaScript to execute in the victim's browser context. The product is End-of-Life, and the vendor will not release patches for this issue.

Critical Impact
Attackers can execute arbitrary JavaScript in a victim's browser session by luring users to a specially crafted URL. Because the product is End-of-Life, no vendor patch will be issued.

Affected Products

Widzialni PAD CMS (all versions, End-of-Life)
PAD CMS www template
PAD CMS bip and www+bip templates

Discovery Timeline

2025-09-30 - CVE-2025-8116 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-8116

Vulnerability Analysis

The vulnerability is a Reflected XSS flaw classified under [CWE-79]: Improper Neutralization of Input During Web Page Generation. The print and save-to-PDF handlers in PAD CMS reflect user-supplied URL parameters into the rendered response without adequate output encoding or input sanitization. When a victim opens a crafted link, the injected script executes with the origin and privileges of the PAD CMS site.

The issue is present across all three deployment templates shipped by Widzialni, meaning site administrators cannot mitigate the flaw by switching templates. Because PAD CMS is End-of-Life, no upstream fix will be published. Exploitation requires user interaction, and the impact is limited to the browser session of the targeted user, including session cookies, page content, and any actions performable within the PAD CMS interface.

Root Cause

The print-to-PDF routine takes attacker-controllable input from the request and injects it into the generated HTML response without contextual output encoding. Standard HTML entity escaping or a strict Content Security Policy would prevent script execution, but neither is enforced in the affected code paths.

Attack Vector

Exploitation occurs over the network and requires the victim to click a malicious link or visit an attacker-controlled page that triggers navigation to the crafted URL. Once executed, the injected script can steal session tokens, perform actions as the authenticated user, deface content, or pivot to further attacks against site administrators handling Public Information Bulletin (bip) content.

No verified public proof-of-concept code is available. See the CERT.pl analysis for technical background on the disclosure.

Detection Methods for CVE-2025-8116

Indicators of Compromise

HTTP requests to PAD CMS print or save-to-PDF endpoints containing script tags, JavaScript URI schemes, or HTML event handler attributes in query parameters.
Referrer headers pointing to unfamiliar external sites immediately preceding requests to print/PDF endpoints.
Web server access logs showing URL-encoded payloads such as %3Cscript%3E, onerror=, or javascript: targeting PAD CMS routes.

Detection Strategies

Deploy a Web Application Firewall (WAF) rule that inspects query strings on PAD CMS print and PDF endpoints for XSS payload signatures.
Enable verbose HTTP logging on the reverse proxy or web server hosting PAD CMS and forward logs to a SIEM for pattern matching against known XSS payloads.
Correlate anomalous outbound requests from user browsers with prior visits to PAD CMS URLs containing suspicious parameters.

Monitoring Recommendations

Alert on any request to PAD CMS containing <script, onerror=, onload=, or javascript: in URL parameters.
Track unusual spikes in traffic to print/PDF endpoints originating from external referrers.
Monitor administrator sessions for unexpected privilege actions following visits to reflected content pages.

How to Mitigate CVE-2025-8116

Immediate Actions Required

Plan migration away from PAD CMS, as the product is End-of-Life and will not receive vendor patches.
Restrict access to PAD CMS administrative interfaces by IP allowlist where feasible.
Deploy a WAF in front of PAD CMS with rules blocking common reflected XSS payloads on print and PDF handlers.
Educate site editors and administrators to avoid clicking untrusted links referencing the PAD CMS domain.

Patch Information

No patch is available. Widzialni has confirmed the product is End-of-Life and will not publish fixes for this vulnerability. Refer to the CERT.pl advisory for authoritative guidance.

Workarounds

Enforce a strict Content Security Policy (CSP) header at the reverse proxy level to block inline script execution, for example Content-Security-Policy: default-src 'self'; script-src 'self'.
Configure the reverse proxy to strip or reject requests to print/PDF endpoints that contain HTML metacharacters in query parameters.
Set the HttpOnly and Secure flags on session cookies to reduce the impact of script-based token theft.
Where the print/PDF feature is not required, disable the corresponding routes at the web server or application layer.

bash

# Example nginx configuration to block script payloads on PAD CMS print endpoints
location ~* /(print|pdf) {
    if ($args ~* "(<|%3C)script|javascript:|onerror=|onload=") {
        return 403;
    }
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'" always;
    add_header X-XSS-Protection "1; mode=block" always;
    proxy_pass http://pad_cms_backend;
}