CVE-2026-10567: 1Panel-dev CordysCRM XSS Vulnerability

CVE-2026-10567 Overview

CVE-2026-10567 is a stored cross-site scripting (XSS) vulnerability in 1Panel-dev CordysCRM through version 1.4.1. The flaw resides in the Save function of src/main/java/cn/cordys/crm/system/service/ModuleFormService.java within the ModuleFormController component. Attackers can manipulate the Description argument to inject arbitrary script content that executes in the browser of any user viewing the affected form. The issue is tracked under [CWE-79] and is exploitable remotely over the network with low privileges. A public exploit disclosure exists, but no in-the-wild exploitation has been confirmed. Upgrading to CordysCRM 1.7.0 resolves the issue via patch commit c87682afa8df79853299f75489c9d333f7bc5fce.

Critical Impact
Authenticated attackers can store malicious JavaScript inside CRM module descriptions, enabling session theft, credential harvesting, and account takeover when other users render the affected forms.

Affected Products

1Panel-dev CordysCRM versions up to and including 1.4.1
Component: ModuleFormController (ModuleFormService.java)
Fixed version: CordysCRM 1.7.0

Discovery Timeline

2026-06-02 - CVE-2026-10567 published to NVD
2026-06-02 - Last updated in NVD database

Technical Details for CVE-2026-10567

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw classified as [CWE-79]. CordysCRM accepts user-supplied input through the Description parameter handled by the Save method in ModuleFormService.java. The application persists this input and later renders it in the browser without sufficient output encoding or sanitization. An authenticated attacker with low privileges can submit a crafted payload containing HTML or JavaScript that executes when other users view the affected module form.

Because the payload is stored server-side, it triggers automatically for every user who loads the affected view. Successful exploitation requires victim interaction such as opening a CRM page, but no additional privileges. The impact is limited to integrity of the rendered page, with no direct effect on confidentiality or availability at the application level.

Root Cause

The root cause is the absence of consistent HTML escaping and URL-scoped XSS filtering across request handlers in the CordysCRM backend. The Save operation in ModuleFormController writes the Description field to persistent storage and returns it during rendering without enforcing context-aware encoding. Prior builds relied on an all-or-nothing xss.escape.all.enabled flag that defaulted to false, leaving most input pathways unprotected.

Attack Vector

The attack vector is network-based and requires an authenticated low-privilege account. The attacker submits a crafted Description value to the module form endpoint. When an administrator or peer user opens the affected record, the stored payload executes in their browser context, enabling session token theft, forced actions, or phishing overlays.

text

# Patch excerpt: backend/app/src/main/resources/commons.properties
# Source: https://github.com/1Panel-dev/CordysCRM/commit/c87682afa8df79853299f75489c9d333f7bc5fce

# Enable whitelist functionality, if not enabled, access will not be restricted.
dashboard.whitelist.allowed=

# List of URLs that require XSS filtering, supports Ant-style path matching, e.g., /api/**.
# If no URLs need to be filtered, it can be left empty.
# xss.protection.url.list=/account/follow/**,/announcement/add

java

// Patch excerpt: backend/framework/src/main/java/cn/cordys/config/RequestParamTrimConfig.java
// Source: https://github.com/1Panel-dev/CordysCRM/commit/c87682afa8df79853299f75489c9d333f7bc5fce

import com.fasterxml.jackson.core.JsonParser;
import com.fasterxml.jackson.databind.DeserializationContext;
import com.fasterxml.jackson.databind.deser.std.StdScalarDeserializer;
import jakarta.servlet.http.HttpServletRequest;
import org.apache.commons.lang3.StringUtils;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.boot.autoconfigure.jackson.Jackson2ObjectMapperBuilderCustomizer;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.util.AntPathMatcher;
import org.springframework.web.context.request.RequestContextHolder;
import org.springframework.web.context.request.ServletRequestAttributes;
import org.springframework.web.util.HtmlUtils;

import java.io.IOException;
import java.util.Arrays;

The patch introduces a configurable xss.protection.url.list property and wires Spring's AntPathMatcher with HtmlUtils HTML escaping into the request deserialization pipeline. This applies context-aware sanitization to specified endpoints rather than relying on a global toggle.

Detection Methods for CVE-2026-10567

Indicators of Compromise

HTTP POST requests to CordysCRM ModuleForm save endpoints containing <script>, onerror=, onload=, or javascript: patterns in the Description field.
CRM records whose Description columns contain unexpected HTML tags or encoded JavaScript payloads.
Outbound browser requests from authenticated CRM users to attacker-controlled domains shortly after viewing module forms.

Detection Strategies

Inspect application logs and request bodies for module form submissions containing HTML or JavaScript syntax in user-controlled string fields.
Run database content scans against CordysCRM tables backing module form descriptions for stored script tags or event handler attributes.
Correlate authentication events with anomalous administrative actions performed shortly after rendering a CRM module page, which may indicate session abuse.

Monitoring Recommendations

Enable verbose request logging for all /api/** endpoints exposed by CordysCRM and alert on payloads matching XSS signatures.
Monitor the CordysCRM GitHub repository for new advisories and watch for activity referencing VulDB report 367674.
Track browser Content Security Policy (CSP) violation reports from CRM users to surface injection attempts in real time.

How to Mitigate CVE-2026-10567

Immediate Actions Required

Upgrade CordysCRM to version 1.7.0 or later, which includes the fix from commit c87682afa8df79853299f75489c9d333f7bc5fce.
Audit existing module form records for stored JavaScript payloads and purge any malicious content from the database.
Rotate session tokens and force re-authentication for users who may have rendered tampered records.

Patch Information

The fix is delivered in CordysCRM v1.7.0. The relevant changes are captured in commit c87682a and pull request #2356, which add a configurable xss.protection.url.list setting and integrate HTML escaping into the request handling layer. The originating issue is tracked at GitHub issue #2233.

Workarounds

If immediate patching is not possible, enable the new xss.protection.url.list property (after applying the patch) and explicitly include the ModuleForm save endpoint in the filtered URL list.
Restrict access to the CordysCRM administration interface to trusted internal networks via firewall or reverse proxy rules.
Deploy a web application firewall (WAF) rule that blocks HTML and JavaScript syntax in the Description parameter for module form requests.

bash

# Configuration example: enable URL-scoped XSS filtering in CordysCRM 1.7.0
# File: backend/app/src/main/resources/commons.properties

# Restrict dashboard access (optional)
dashboard.whitelist.allowed=

# Apply XSS filtering to module form and related endpoints
xss.protection.url.list=/api/system/module/**,/api/account/follow/**,/announcement/add