CVE-2026-10529: CicadasCMS XSS Vulnerability

CVE-2026-10529 Overview

CVE-2026-10529 is a cross-site scripting (XSS) vulnerability affecting westboy CicadasCMS up to commit 2431154dac8d0735e04f1fd2a3c3556668fc8dab. The flaw resides in the Task Scheduling Management Module, specifically within src/main/java/com/zhiliao/module/web/system/ScheduleJobController.java. Attackers can inject malicious script content remotely, which executes in the browser context of users interacting with the affected interface. A public exploit is available, increasing the likelihood of opportunistic abuse. CicadasCMS uses a rolling release model, so no fixed version identifier is available. The maintainers were notified through an issue report but have not responded.

Critical Impact
Authenticated attackers can inject script payloads via the Task Scheduling Management Module to execute arbitrary JavaScript in victim browsers, enabling session abuse and UI manipulation.

Affected Products

westboy CicadasCMS up to commit 2431154dac8d0735e04f1fd2a3c3556668fc8dab
Task Scheduling Management Module (ScheduleJobController.java)
Rolling release builds with no discrete version identifier

Discovery Timeline

2026-06-02 - CVE-2026-10529 published to NVD
2026-06-02 - Last updated in NVD database

Technical Details for CVE-2026-10529

Vulnerability Analysis

The vulnerability is classified under [CWE-79] Improper Neutralization of Input During Web Page Generation. An unknown function within ScheduleJobController.java accepts user-controlled input and renders it back into the application interface without adequate output encoding. When an authenticated user with sufficient privileges submits crafted input through the Task Scheduling Management Module, the payload is stored or reflected and later executed in another user's browser session.

Exploitation requires high privileges and user interaction, which limits broad mass-exploitation scenarios. However, because the Task Scheduling Management Module is an administrative surface, successful injection can target other administrators and operators who routinely access the same views. A public exploit lowers the technical barrier for attackers seeking to weaponize the flaw. The EPSS score of 0.033% reflects a low forecast of imminent exploitation activity in the broader internet population.

Root Cause

The controller does not consistently apply contextual output encoding to fields rendered in the scheduling management views. Input destined for HTML contexts is emitted without HTML entity escaping, allowing <script> tags and event-handler attributes to survive into the rendered DOM. The absence of a Content Security Policy further enables inline script execution.

Attack Vector

An authenticated attacker submits a crafted job name, description, or parameter value to an endpoint handled by ScheduleJobController.java. The payload persists in the application state and renders when another privileged user opens the scheduling view, triggering JavaScript execution in that user's session. Outcomes include cookie theft, forced administrative actions, and pivoting through the management console.

No verified proof-of-concept code is published in the NVD reference set. See the Gitee CicadasCMS Issue IJLMAG and VulDB entry for CVE-2026-10529 for additional technical context.

Detection Methods for CVE-2026-10529

Indicators of Compromise

Job records in the Task Scheduling Management Module containing HTML tags, <script> blocks, or on*= event handlers in name or description fields
Outbound HTTP requests from administrator browsers to unfamiliar domains immediately after viewing the scheduler
Unexpected session token reuse from new IP addresses following access to the task scheduling interface

Detection Strategies

Inspect HTTP POST bodies to endpoints served by ScheduleJobController.java for script tags, encoded payloads, and JavaScript URIs
Review database tables backing the scheduled job entities for stored markup or script content in user-supplied fields
Correlate administrative authentication events with anomalous follow-on actions performed from the same session

Monitoring Recommendations

Enable web server access logging on all CicadasCMS administrative routes and forward to a central analytics platform
Alert on responses from administrative views that contain script content reflected from request parameters
Monitor browser-side errors and CSP violation reports if a policy is deployed in front of the application

How to Mitigate CVE-2026-10529

Immediate Actions Required

Restrict access to the CicadasCMS administrative interface to trusted networks using firewall or reverse proxy controls
Audit existing scheduled job records and remove any entries containing HTML or JavaScript content in text fields
Limit which accounts hold the high privileges required to submit scheduled jobs until a code fix is available

Patch Information

No official patch has been published. The project uses a rolling release with no version identifiers, and the maintainers have not responded to the issue report tracked at Gitee CicadasCMS Issue IJLMAG. Monitor the Gitee CicadasCMS Repository for commits addressing ScheduleJobController.java.

Workarounds

Place a web application firewall in front of CicadasCMS with rules blocking script tags and JavaScript URI schemes on administrative POST endpoints
Apply a strict Content Security Policy that disallows inline script execution in the administrative console
Implement server-side input validation that rejects HTML metacharacters in scheduled job names, descriptions, and parameters

bash

# Example nginx Content Security Policy header for CicadasCMS administrative paths
location /system/scheduleJob/ {
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'" always;
    add_header X-XSS-Protection "1; mode=block" always;
    proxy_pass http://cicadascms_backend;
}