CVE-2026-31351: Feehi CMS Stored XSS Vulnerability

CVE-2026-31351 Overview

CVE-2026-31351 is an authenticated stored cross-site scripting (XSS) vulnerability discovered in Feehi CMS version 2.1.1. The vulnerability exists within the creation/editing module, where attackers with authenticated access can inject malicious web scripts or HTML code through the Title parameter. Once stored, this payload executes in the browsers of other users who view the affected content, potentially leading to session hijacking, credential theft, or further malicious actions within the CMS environment.

Critical Impact
Authenticated attackers can inject persistent malicious scripts that execute in victim browsers, potentially compromising admin sessions and enabling further attacks against the CMS infrastructure.

Affected Products

Feehi CMS version 2.1.1
feehi:feehi_cms component

Discovery Timeline

2026-04-06 - CVE-2026-31351 published to NVD
2026-04-07 - Last updated in NVD database

Technical Details for CVE-2026-31351

Vulnerability Analysis

This stored XSS vulnerability (CWE-79) allows authenticated users to inject malicious payloads that persist in the application's database and execute when other users access the affected content. The vulnerability stems from improper sanitization of user-supplied input in the Title parameter of the content creation and editing module.

Unlike reflected XSS attacks that require victims to click malicious links, stored XSS vulnerabilities are particularly dangerous because the malicious payload is permanently stored on the target server. Any user who views the affected page will have the malicious script execute in their browser context, making this attack vector more persistent and potentially more damaging.

The attack requires the attacker to have authenticated access to the CMS with permissions to create or edit content. While this prerequisite limits the initial attack surface, it represents a significant risk in multi-user environments where content contributors may not be fully trusted.

Root Cause

The root cause of this vulnerability is insufficient input validation and output encoding in the Feehi CMS content management module. The application fails to properly sanitize user-supplied input in the Title parameter before storing it in the database and subsequently fails to encode this data when rendering it in HTML output. This allows HTML and JavaScript code to be interpreted by browsers rather than displayed as plain text.

Attack Vector

The attack is executed over the network and requires the attacker to have authenticated access with content creation privileges. The attacker crafts a malicious payload containing JavaScript or HTML code and injects it into the Title parameter when creating or editing content within the CMS.

When other users, including administrators, view pages containing this content, their browsers execute the injected script in the context of the application. This can lead to:

Session token theft through cookie exfiltration
Keylogging of administrator credentials
Defacement of the CMS interface
Redirection to phishing pages
Installation of browser-based cryptocurrency miners

The attack requires user interaction (another user must view the affected content), but in an active CMS environment, this is highly likely to occur naturally as administrators and users interact with the content management interface. For detailed technical information, see the GitHub Issue #81 Discussion.

Detection Methods for CVE-2026-31351

Indicators of Compromise

Unusual JavaScript code or HTML tags present in content Title fields within the database
Unexpected script execution errors in browser console logs when viewing CMS content
Reports of browser redirects or pop-ups from users accessing the CMS administration interface
Network traffic to unknown external domains originating from user sessions viewing CMS content

Detection Strategies

Implement web application firewall (WAF) rules to detect and block common XSS payloads in POST request parameters
Review database content for suspicious HTML tags and JavaScript code in Title fields
Monitor HTTP response headers for missing or misconfigured Content-Security-Policy settings
Deploy endpoint detection solutions to identify browser-based script injection behavior

Monitoring Recommendations

Enable detailed logging for all content creation and modification events in the CMS
Set up alerts for content containing potentially malicious patterns such as <script>, javascript:, or event handlers like onerror
Monitor for abnormal session activity patterns that may indicate session hijacking
Implement Content Security Policy (CSP) reporting to detect inline script execution attempts

How to Mitigate CVE-2026-31351

Immediate Actions Required

Audit all existing content in Feehi CMS for potentially malicious payloads in Title fields
Restrict content creation and editing permissions to trusted users only
Implement Content Security Policy headers to prevent inline script execution
Consider temporarily disabling public access to affected content areas until patched

Patch Information

Refer to the Feehi CMS GitHub repository and the GitHub Issue #81 Discussion for the latest security updates and patch information regarding this vulnerability. Organizations should monitor the vendor's official channels for security releases that address this XSS vulnerability.

Workarounds

Implement server-side input validation that strips or encodes HTML special characters from the Title parameter
Deploy a web application firewall (WAF) with XSS protection rules enabled
Add Content-Security-Policy headers that restrict inline script execution: Content-Security-Policy: script-src 'self';
Perform manual output encoding using HTML entities when rendering user-supplied content
Limit CMS access to trusted IP ranges or VPN connections to reduce the attack surface

bash

# Example Content-Security-Policy header configuration for Apache
# Add to .htaccess or virtual host configuration
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'none';"

# Example for Nginx
# Add to server block configuration
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'none';";