CVE-2026-10514: 1Panel-dev CordysCRM XSS Vulnerability

CVE-2026-10514 Overview

CVE-2026-10514 is a cross-site scripting (XSS) vulnerability affecting 1Panel-dev CordysCRM versions up to and including 1.6.2. The flaw resides in the backend/framework/src/main/java/cn/cordys/config/RequestParamTrimConfig.java component, where request parameter handling fails to neutralize HTML and script content. An authenticated remote attacker can manipulate input to inject script payloads that execute in another user's browser session. The issue is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The vendor addressed the issue in version 1.7.0 via commit c87682afa8df79853299f75489c9d333f7bc5fce.

Critical Impact
Authenticated attackers can inject script content through request parameters, potentially leading to session abuse or limited integrity compromise within the CordysCRM application context.

Affected Products

1Panel-dev CordysCRM versions up to and including 1.6.2
Component: backend/framework/src/main/java/cn/cordys/config/RequestParamTrimConfig.java
Fixed in CordysCRM 1.7.0

Discovery Timeline

2026-06-02 - CVE-2026-10514 published to NVD
2026-06-02 - Last updated in NVD database
Patch commit - c87682afa8df79853299f75489c9d333f7bc5fce merged in the CordysCRM repository

Technical Details for CVE-2026-10514

Vulnerability Analysis

The vulnerability stems from inadequate sanitization within the request parameter trimming configuration. RequestParamTrimConfig.java processes incoming HTTP request parameters before they reach controller logic. Prior to the fix, this configuration did not apply HTML escaping or selective filtering to URL paths handling user-controlled input. Attackers can submit crafted parameter values containing script payloads. When the application later renders these values in responses, the payload executes in the victim's browser. Exploitation requires high privileges and user interaction, which limits practical impact but does not eliminate it in multi-user CRM deployments.

Root Cause

The root cause is missing output encoding for parameters passed through the trimming filter. The pre-patch code lacked integration with Spring's HtmlUtils for selective endpoints and did not consult a configurable URL allowlist. A global escape toggle (xss.escape.all.enabled) existed but defaulted to disabled, leaving most application paths exposed to reflected and stored XSS.

Attack Vector

Exploitation occurs over the network through the standard web interface. An authenticated user with elevated privileges submits a request containing a script-bearing parameter. The unsanitized value is stored or reflected, and a second user viewing the affected resource triggers script execution. The exploit details have been publicly disclosed, increasing the likelihood of opportunistic abuse against unpatched instances.

java

// Patch excerpt: RequestParamTrimConfig.java
import com.fasterxml.jackson.core.JsonParser;
import com.fasterxml.jackson.databind.DeserializationContext;
import com.fasterxml.jackson.databind.deser.std.StdScalarDeserializer;
import jakarta.servlet.http.HttpServletRequest;
import org.apache.commons.lang3.StringUtils;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.boot.autoconfigure.jackson.Jackson2ObjectMapperBuilderCustomizer;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.util.AntPathMatcher;
import org.springframework.web.context.request.RequestContextHolder;
import org.springframework.web.context.request.ServletRequestAttributes;
import org.springframework.web.util.HtmlUtils;

import java.io.IOException;
import java.util.Arrays;

Source: GitHub Commit Change Log. The patch introduces HttpServletRequest context retrieval and AntPathMatcher to apply HtmlUtils escaping only on URLs listed in xss.protection.url.list.

Detection Methods for CVE-2026-10514

Indicators of Compromise

HTTP request parameters containing <script>, javascript:, or HTML event handler attributes such as onerror= and onload= directed at CordysCRM endpoints.
Unexpected stored content in CRM records containing encoded or raw script tags within fields normally constrained to plain text.
Anomalous outbound requests from user browsers to attacker-controlled domains shortly after viewing CRM records.

Detection Strategies

Inspect web access logs for query strings and POST bodies matching XSS payload signatures targeting CordysCRM paths.
Deploy a web application firewall ruleset that flags reflected script content in responses originating from the CordysCRM backend.
Run version inventory checks against deployed CordysCRM instances and flag any release prior to 1.7.0.

Monitoring Recommendations

Continuously monitor authentication logs for high-privilege accounts submitting unusual parameter content.
Alert on Content Security Policy violation reports generated by CordysCRM pages.
Track database write events to CRM tables for entries containing HTML markup that was not previously expected.

How to Mitigate CVE-2026-10514

Immediate Actions Required

Upgrade CordysCRM to version 1.7.0 or later, which includes commit c87682afa8df79853299f75489c9d333f7bc5fce.
Audit existing CRM records for stored payloads injected before patching.
Rotate session tokens for any account that may have viewed attacker-controlled CRM content.

Patch Information

The vendor released the fix in CordysCRM v1.7.0. The patch implements configurable XSS protection via the xss.protection.url.list property, applies Ant-style path matching, and escapes HTML through HtmlUtils for the configured endpoints. Refer to the GitHub Pull Request Discussion and the GitHub Issue Tracker Entry for context.

Workarounds

If upgrading immediately is not feasible, restrict access to CordysCRM administrative functions to trusted network ranges.
Apply a reverse proxy filter that strips or encodes HTML metacharacters in inbound parameters destined for vulnerable endpoints.
Enforce a strict Content Security Policy that disables inline scripts on CordysCRM responses.

bash

# Post-upgrade configuration example for commons.properties
# List of URLs that require XSS filtering, supports Ant-style path matching.
xss.protection.url.list=/account/follow/**,/announcement/add