CVE-2026-10153: CicadasCMS Cross-Site Scripting Vulnerability

CVE-2026-10153 Overview

CVE-2026-10153 is a cross-site scripting (XSS) vulnerability in westboy CicadasCMS affecting the Search function in org/springframework/cache/support/AbstractCacheManager.java. Manipulation of the s argument causes reflected script execution in the victim's browser. The flaw is remotely exploitable over the network and requires user interaction. A public exploit has been disclosed, increasing the likelihood of opportunistic abuse. CicadasCMS follows a rolling release model, so no fixed version is published. The maintainers were notified through an issue report but have not yet responded. The weakness is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Attackers can inject arbitrary JavaScript through the search parameter, enabling session theft, phishing redirection, and client-side actions in the context of authenticated users.

Affected Products

westboy CicadasCMS up to commit 2431154dac8d0735e04f1fd2a3c3556668fc8dab
Rolling-release branches of the Gitee-hosted CicadasCMS repository
Deployments exposing the Search endpoint to untrusted users

Discovery Timeline

2026-05-30 - CVE-2026-10153 published to NVD
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-10153

Vulnerability Analysis

The vulnerability resides in the Search function reachable through the CicadasCMS web interface. User-supplied input to the s query parameter is reflected into the rendered response without proper neutralization of HTML and JavaScript control characters. Because the response is delivered to the browser as HTML, an attacker can craft a URL containing script payloads that execute in the victim's session when the link is opened.

The issue is reflected XSS, which requires the target user to interact with an attacker-supplied link or page. Successful exploitation runs script in the origin of the vulnerable CicadasCMS instance, exposing cookies accessible to JavaScript, the DOM, and any application APIs the user can reach.

Root Cause

The root cause is missing output encoding of the s search argument before it is written into the HTML response. The application trusts the inbound parameter and renders it verbatim, violating the contextual encoding requirements of [CWE-79]. There is no allow-list filtering or HTML entity escaping applied prior to template rendering.

Attack Vector

An attacker crafts a URL targeting the search endpoint with a malicious s parameter containing script content. The attacker delivers the link through phishing, forum posts, or third-party sites. When an authenticated user opens the link, the injected script executes in their browser. The exploit has been publicly disclosed through VulDB submission #818792 and tracked as VulDB Vulnerability #367406.

No verified proof-of-concept code is reproduced here. Refer to the Gitee CicadasCMS Issue IJKWOH for project-level details.

Detection Methods for CVE-2026-10153

Indicators of Compromise

HTTP requests to CicadasCMS search endpoints containing <script>, onerror=, javascript:, or encoded variants in the s parameter
Outbound browser requests to attacker-controlled domains immediately after a user visits a CicadasCMS search URL
Unexpected session cookie access patterns or token replay from new IP addresses following user interaction with crafted links

Detection Strategies

Inspect web server and reverse proxy logs for search requests where the s parameter contains HTML tags, event handlers, or URL-encoded script delimiters
Deploy Content Security Policy (CSP) violation reporting to surface inline script execution attempts in production
Run signature and heuristic rules in a Web Application Firewall (WAF) covering reflected XSS payload patterns against the search route

Monitoring Recommendations

Alert on anomalous spikes in 200-status responses from the search endpoint containing reflected parameter values longer than expected
Correlate user click telemetry from email and chat security gateways with subsequent requests to the CicadasCMS instance
Monitor administrative account sessions for behavior originating from browsers that recently rendered crafted search responses

How to Mitigate CVE-2026-10153

Immediate Actions Required

Restrict access to the CicadasCMS search endpoint behind authentication or IP allow-listing where feasible
Place a WAF in front of the application with rules blocking reflected XSS patterns in the s parameter
Apply a strict Content Security Policy that disallows inline scripts and untrusted script sources
Educate users and administrators to avoid clicking unsolicited links pointing to the CicadasCMS search route

Patch Information

No official patch is available. CicadasCMS uses a rolling release model, and the project has not responded to the issue report at the time of publication. Monitor the Gitee CicadasCMS Repository and the VulDB CTI entry for #367406 for updates. Once a fix lands, redeploy from the latest commit and validate that the s parameter is HTML-encoded in responses.

Workarounds

Add server-side input validation that rejects or HTML-encodes non-alphanumeric characters in the s parameter before reflection
Configure response headers including Content-Security-Policy, X-Content-Type-Options: nosniff, and X-XSS-Protection as defense-in-depth
Disable or remove the public search route until the vendor releases a verified fix if business requirements allow

bash

# Configuration example: NGINX rule to block obvious XSS payloads on the search endpoint
location /search {
    if ($arg_s ~* "(<|%3C)\s*script|onerror=|javascript:") {
        return 403;
    }
    proxy_pass http://cicadascms_backend;
}