CVE-2026-32277: Connect-CMS Cabinet Plugin XSS Vulnerability

CVE-2026-32277 Overview

CVE-2026-32277 is a DOM-based Cross-Site Scripting (XSS) vulnerability in Connect-CMS, an open-source content management system maintained by opensource-workshop. The flaw resides in the Cabinet Plugin list view and affects versions 1.35.0 through 1.41.0 and 2.35.0 through 2.41.0. The maintainers released patched builds 1.41.1 and 2.41.1 to address the issue. The weakness is classified under CWE-79, Improper Neutralization of Input During Web Page Generation.

Critical Impact
Authenticated attackers can inject script that executes in other users' browsers when they view the Cabinet Plugin list, leading to session theft, account takeover, and content manipulation across the affected site.

Affected Products

Connect-CMS versions 1.35.0 through 1.41.0
Connect-CMS versions 2.35.0 through 2.41.0
opensource-workshop Connect-CMS deployments using the Cabinet Plugin

Discovery Timeline

2026-03-23 - CVE-2026-32277 published to NVD
2026-03-24 - Last updated in NVD database

Technical Details for CVE-2026-32277

Vulnerability Analysis

The vulnerability is a DOM-based Cross-Site Scripting flaw located in the Cabinet Plugin list view of Connect-CMS. DOM-based XSS occurs when client-side JavaScript writes attacker-controlled data into the Document Object Model without proper neutralization. In this case, the Cabinet Plugin renders file or folder metadata into the page using a sink that does not escape HTML or JavaScript contexts.

Exploitation requires an authenticated user with permission to influence Cabinet Plugin content. A second user must then load the Cabinet list view for the injected payload to execute. Successful exploitation runs JavaScript in the victim's browser under the application's origin. Attackers can hijack session cookies, issue requests on behalf of the victim, modify CMS content, or pivot toward administrative accounts.

The scope change reflected in the CVSS vector indicates the injected script can reach resources beyond the vulnerable component, including authenticated sessions for the wider CMS.

Root Cause

The root cause is missing output encoding in the client-side rendering path of the Cabinet Plugin list view. User-controlled values flow into a DOM sink without contextual escaping, allowing HTML and script content to be parsed as markup rather than text. The remediation commit c04dc40f814eff891915752ef1ec00ba6612441c adjusts the affected rendering logic, as documented in the GitHub Security Advisory GHSA-cmfh-mpmf-fmq4.

Attack Vector

The attack is delivered over the network and requires low privileges combined with user interaction. An attacker first authenticates and stores a malicious payload through the Cabinet Plugin. When another authenticated user navigates to the Cabinet list view, the browser parses the payload and executes the embedded script. No special tooling is needed beyond a browser and valid CMS credentials.

Technical details of the fix are available in the GitHub Release v1.41.1 and GitHub Release v2.41.1 notes. No public proof-of-concept exploit code is currently associated with this CVE.

Detection Methods for CVE-2026-32277

Indicators of Compromise

Cabinet Plugin entries containing HTML tags such as <script>, <img onerror=...>, or <svg onload=...> in file names, descriptions, or related metadata fields.
Web server logs showing POST requests to Cabinet Plugin endpoints with payloads containing JavaScript event handlers or encoded angle brackets.
Outbound browser requests from users viewing the Cabinet list to unfamiliar domains shortly after page load, indicating script-driven exfiltration.

Detection Strategies

Inspect Cabinet Plugin database tables for stored values containing HTML or JavaScript syntax and review change history for suspicious edits by low-privilege accounts.
Deploy a Content Security Policy in report-only mode and monitor violation reports for inline-script execution on Cabinet list pages.
Apply web application firewall rules that flag XSS patterns on requests targeting Cabinet Plugin routes, with elevated logging for authenticated sessions.

Monitoring Recommendations

Alert on Connect-CMS administrator session activity that originates from new IP addresses immediately after a Cabinet list view is rendered.
Track failed and successful authentication events for accounts with content-editing permissions to identify staging activity for stored XSS.
Forward CMS application logs and web server access logs to a centralized analytics platform and correlate Cabinet Plugin writes with subsequent administrative actions.

How to Mitigate CVE-2026-32277

Immediate Actions Required

Upgrade Connect-CMS to version 1.41.1 or 2.41.1 to apply the official patch.
Audit Cabinet Plugin content created or modified during the vulnerable window and remove entries containing HTML or script syntax.
Rotate session cookies and force re-authentication for administrators and content editors after patching.

Patch Information

The maintainers fixed the vulnerability in releases 1.41.1 and 2.41.1. The remediation is delivered through commit c04dc40f814eff891915752ef1ec00ba6612441c. Coordinated disclosure details are documented in the GitHub Security Advisory GHSA-cmfh-mpmf-fmq4, and release artifacts are available in the v1.41.1 release notes and v2.41.1 release notes.

Workarounds

Restrict access to the Cabinet Plugin to trusted users only until the patched version is deployed.
Enforce a strict Content Security Policy that blocks inline scripts and limits script sources to known origins.
Disable the Cabinet Plugin in affected sites if patching cannot be completed in the short term.

bash

# Configuration example: upgrade Connect-CMS to a patched release
git fetch --tags
git checkout v1.41.1   # or v2.41.1 for the 2.x branch
composer install --no-dev --optimize-autoloader
php artisan migrate --force
php artisan config:clear