CVE-2026-11772: DRIMO CMS Reflected XSS Vulnerability

CVE-2026-11772 Overview

CVE-2026-11772 is a reflected Cross-Site Scripting (XSS) vulnerability in DRIMO CMS. The flaw resides in the search functionality, where the q parameter reflects unsanitized user input into the response. An attacker can craft a malicious URL that, when opened by a victim, executes arbitrary JavaScript in the victim's browser. DRIMO CMS has reached End Of Life and will not receive vendor patches. Administrators must mitigate the vulnerability manually by deleting the info.php file. The issue is tracked as CWE-79 and was published by CERT Poland.

Critical Impact
A crafted URL targeting the search q parameter executes attacker-controlled JavaScript in the victim's browser, enabling session theft, credential harvesting, and content manipulation.

Affected Products

DRIMO CMS (all versions — product is End Of Life)
Deployments exposing the info.php search endpoint
Web applications built on DRIMO CMS search functionality

Discovery Timeline

2026-06-23 - CVE-2026-11772 published to NVD
2026-06-23 - Last updated in NVD database
2026-06-23 - CERT Poland publishes advisory (CERT Poland CVE-2026-11772 Post)

Technical Details for CVE-2026-11772

Vulnerability Analysis

The vulnerability is a reflected XSS issue in the DRIMO CMS search component. The application accepts user input through the q query parameter and embeds it directly into the rendered HTML response without proper output encoding or contextual sanitization. As a result, attacker-supplied script content is parsed and executed by the victim's browser when the crafted URL is opened. The reflected nature requires user interaction, which is consistent with the CVSS user-interaction requirement. Exploitation does not require authentication, and the attack vector is the network. The EPSS score is 0.378% (29.59 percentile), indicating low predicted exploitation activity at the time of publication.

Root Cause

The root cause is improper neutralization of input during web page generation, classified as CWE-79. The search handler reflects the q parameter into HTML output without encoding characters such as <, >, ", and '. Because DRIMO CMS is End Of Life, the vendor will not issue a code-level fix.

Attack Vector

An attacker crafts a URL containing JavaScript payload data in the q parameter and delivers it to a victim through phishing, chat, or a malicious referrer. When the victim opens the link, the DRIMO CMS server reflects the payload into the search results page, and the browser executes the injected script in the application's origin context. The attacker can then steal session cookies, perform actions as the user, or render misleading content. See the CERT Poland advisory for additional technical context. No verified proof-of-concept code is published; a synthetic example is omitted to avoid fabrication.

Detection Methods for CVE-2026-11772

Indicators of Compromise

HTTP GET requests to the DRIMO CMS search endpoint containing q= values with <script>, onerror=, onload=, javascript:, or URL-encoded variants of these tokens.
Requests to info.php accompanied by unusual query strings or referrers from external domains.
Web server access logs showing reflected payloads in q parameters mirrored across multiple client IP addresses, indicating a phishing campaign.

Detection Strategies

Inspect web server and reverse-proxy logs for q parameter values containing HTML or JavaScript syntax such as angle brackets, event handlers, or script tokens.
Deploy a Web Application Firewall (WAF) rule set that flags reflected XSS patterns on the search endpoint and alerts on matches.
Monitor outbound browser telemetry from corporate endpoints for connections initiated by scripts originating on DRIMO CMS-hosted pages.

Monitoring Recommendations

Enable detailed HTTP request logging on hosts running DRIMO CMS and forward logs to a central analytics platform for query-time inspection.
Alert on any access to info.php after the recommended deletion step has been applied, since legitimate traffic should be zero.
Track referrer headers and user-agent strings for clusters of inbound traffic carrying suspicious q parameter content.

How to Mitigate CVE-2026-11772

Immediate Actions Required

Delete the info.php file from the DRIMO CMS web root, as recommended by CERT Poland, to remove the vulnerable search functionality.
Block external access to DRIMO CMS search endpoints at the WAF or reverse proxy until the file removal is confirmed.
Plan migration off DRIMO CMS, since the product is End Of Life and will not receive further security updates.

Patch Information

No vendor patch is available. DRIMO CMS is in End Of Life status, and the vendor will not release fixes for CVE-2026-11772. CERT Poland recommends deleting the info.php file as the official mitigation. Refer to the CERT Poland advisory and the Drimo CMS product page for additional information.

Workarounds

Remove the info.php file from the server filesystem to eliminate the reflected XSS sink.
Apply a WAF rule that strips or blocks HTML and JavaScript metacharacters in the q parameter on any path serving DRIMO CMS.
Set a strict Content Security Policy (CSP) header on the application to limit inline script execution and reduce XSS impact during migration.

bash

# Configuration example: remove the vulnerable file and block residual access
sudo rm /var/www/drimo-cms/info.php

# Example nginx rule to block requests targeting info.php with a q parameter
location = /info.php {
    return 404;
}