CVE-2026-37710: Omeka S Cross Site Scripting Vulnerability

CVE-2026-37710 Overview

CVE-2026-37710 is a Cross-Site Scripting (XSS) vulnerability in Omeka S version 4.2.0, an open-source web publishing platform for digital collections. The flaw resides in the site navigation custom URL function, which fails to validate URL schemes before rendering navigation links. Attackers can inject javascript: URIs that execute arbitrary script in a victim's browser when the navigation link is clicked. The vulnerability is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in the context of authenticated Omeka S users, enabling session theft, credential harvesting, and unauthorized administrative actions.

Affected Products

Omeka S version 4.2.0
Omeka S installations exposing site navigation configuration to untrusted editors
Public-facing Omeka S sites rendering user-configured navigation links

Discovery Timeline

2026-08-28 - CVE-2026-37710 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-37710

Vulnerability Analysis

The vulnerability exists in the URL link handler for Omeka S site navigation, located in application/src/Site/Navigation/Link/Url.php. The application accepts user-supplied URLs for custom navigation items without restricting the URL scheme. An attacker with permission to modify site navigation can supply a javascript: scheme URL. When a visitor or administrator clicks the crafted navigation entry, the browser executes the embedded script in the origin of the Omeka S site.

Because the payload executes in the site's origin, script access extends to session cookies, CSRF tokens, and DOM content. The scope change reflected in the CVSS vector indicates that exploitation can affect resources beyond the immediately vulnerable component, such as authenticated administrative sessions.

Root Cause

The root cause is missing scheme validation in the navigation link isValid() routine. The function checked for the presence of a URL string but did not enforce an allowlist of safe schemes such as http, https, or mailto. Dangerous schemes including javascript:, data:, and vbscript: were accepted and rendered directly into the href attribute of anchor tags.

Attack Vector

Exploitation requires an authenticated user with navigation edit privileges to submit a malicious URL, and a target user to click the resulting link. The delivery path is stored: the malicious URL persists in site navigation and executes on each render click. Because user interaction is required, this is a stored reflected-execution pattern rather than automatic drive-by execution.

php

// Security patch in application/src/Site/Navigation/Link/Url.php
// Block javascript: URLs from navigation
            $errorStore->addError('o:navigation', 'Invalid navigation: URL link missing URL');
            return false;
        }
+        if ('javascript' === parse_url($data['url'], \PHP_URL_SCHEME)) {
+            $errorStore->addError('o:navigation', 'Invalid navigation: URL link invalid scheme');
+            return false;
+        }
        return true;
    }

Source: Omeka S commit 8d47b0e

Detection Methods for CVE-2026-37710

Indicators of Compromise

Navigation entries in the Omeka S database containing javascript: or data: scheme prefixes in the url field.
Unexpected outbound requests from user browsers to attacker-controlled domains shortly after clicking site navigation links.
Web server access logs showing repeated GET requests to /s/<site-slug>/ followed by anomalous requests to external hosts referenced in Referer headers.
Modifications to site navigation configuration made by low-privileged or newly created editor accounts.

Detection Strategies

Query the Omeka S database for navigation records containing non-standard URL schemes: SELECT * FROM site WHERE navigation LIKE '%javascript%'.
Deploy web application firewall (WAF) rules that inspect POST bodies to /api/sites and admin navigation endpoints for javascript: or data:text/html patterns.
Enable content security policy (CSP) violation reporting to surface inline script execution attempts against the site origin.

Monitoring Recommendations

Log all changes to site navigation configuration with the acting user, timestamp, and full URL payload.
Alert on any HTTP response from Omeka S pages containing href="javascript: in rendered HTML.
Review audit trails for permission grants that assign navigation edit rights to non-administrative users.

How to Mitigate CVE-2026-37710

Immediate Actions Required

Upgrade Omeka S to a version containing commit 8d47b0e or later, which rejects javascript: schemes at the validation layer.
Audit existing site navigation entries and remove any records containing non-http(s) URL schemes.
Restrict navigation edit permissions to trusted administrative users until patching is complete.
Rotate session cookies and force reauthentication for administrators who may have clicked malicious links.

Patch Information

The vendor fix is available in the Omeka S repository as commit 8d47b0ef2dfabc1dd8c52893400321d1fbb5b5f4. The patch adds a parse_url() scheme check to the URL navigation link handler and rejects the entry with an error before persistence. Additional technical analysis is available in the CVE-2026-37710 research repository.

Workarounds

Apply a strict Content Security Policy that omits unsafe-inline and blocks javascript: navigation, for example Content-Security-Policy: default-src 'self'; script-src 'self'.
Deploy WAF rules to reject any request to Omeka S admin endpoints containing javascript: or data: scheme substrings in URL parameters.
Manually patch application/src/Site/Navigation/Link/Url.php to add the scheme validation shown in the vendor commit until an official release upgrade is possible.

bash

# Content Security Policy header example for Apache/Nginx fronting Omeka S
# Apache (.htaccess or vhost)
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'"

# Nginx
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'" always;