CVE-2026-39275: Cockpit CMS XSS Vulnerability

CVE-2026-39275 Overview

CVE-2026-39275 is a Cross-Site Scripting (XSS) vulnerability in Cockpit CMS version 2.13.5 and earlier. A remote attacker can inject arbitrary script into the application through the item.php, field-select.js, and tags.js components. When a victim renders the affected content in their browser, the injected script executes in the victim's session context.

The flaw enables session hijacking, credential theft, and administrative account takeover when a privileged user views attacker-controlled content. Because Cockpit CMS is a headless content management system used to author and serve content to downstream applications, exploitation can propagate stored payloads to consumers of the CMS API.

Critical Impact
Remote attackers can execute arbitrary JavaScript in the browsers of authenticated Cockpit CMS users, leading to session compromise and potential administrative takeover.

Affected Products

Cockpit CMS version 2.13.5
Cockpit CMS versions prior to 2.13.5
Affected components: item.php, field-select.js, tags.js

Discovery Timeline

2026-08-26 - CVE-2026-39275 published to the National Vulnerability Database (NVD)
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-39275

Vulnerability Analysis

Cockpit CMS is a self-hosted headless CMS written in PHP. The vulnerability resides in three components that render user-supplied content without adequate output encoding. The item.php server-side component handles content item rendering, while field-select.js and tags.js are client-side scripts that process field values and tag metadata in the administrative interface.

When an attacker submits crafted input through fields processed by these components, the payload is stored or reflected back to browser DOM contexts without proper sanitization. Any user, including administrators, who views the affected page triggers execution of the injected script. This is a classic Cross-Site Scripting [CWE-79] weakness affecting both stored and DOM-based sinks.

Root Cause

The root cause is missing or insufficient output encoding when rendering user-controlled data. The affected components pass values into HTML or JavaScript execution contexts without escaping special characters such as <, >, ", and '. The client-side scripts field-select.js and tags.js likely assign untrusted values to sinks such as innerHTML or evaluate them as attribute values.

Attack Vector

An attacker with the ability to submit content, tags, or field values to a Cockpit CMS instance injects a JavaScript payload into a vulnerable field. The payload is stored in the CMS backend and rendered when an editor or administrator loads the affected view. Execution occurs in the victim's browser under the CMS origin, allowing the attacker to read session cookies, issue authenticated API calls, modify content, or pivot to further attacks against the administrative account.

No verified exploitation code is published in the enriched data. Technical details are tracked in the GitHub PoC Repository.

Detection Methods for CVE-2026-39275

Indicators of Compromise

HTTP requests to Cockpit CMS containing script tags, javascript: URIs, or event handler attributes (onerror, onload, onmouseover) in item, field, or tag parameters.
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after loading Cockpit CMS pages.
Content records with anomalous HTML or JavaScript syntax in tag and select-field values.

Detection Strategies

Inspect Cockpit CMS access logs for POST requests to content endpoints containing encoded XSS payloads such as %3Cscript%3E or onerror=.
Deploy a Content Security Policy (CSP) report-only header and monitor violation reports for inline script execution in the CMS admin interface.
Review stored content in the Cockpit database for HTML markup in fields that should hold plain text.

Monitoring Recommendations

Enable web application firewall (WAF) rules that flag XSS signatures on requests targeting /admin/, item creation endpoints, and tag management APIs.
Log and alert on administrator session cookie access patterns that deviate from baseline, such as sudden API calls from new IP addresses reusing an active session.
Correlate CMS request logs with browser telemetry to identify script execution originating from CMS-rendered pages.

How to Mitigate CVE-2026-39275

Immediate Actions Required

Upgrade Cockpit CMS to a version later than 2.13.5 once the maintainer publishes a fixed release. Track the project repository for patch availability.
Restrict access to the Cockpit CMS administrative interface to trusted networks or VPN-only until a patch is applied.
Audit existing content, tags, and field values for injected HTML or JavaScript and remove any suspicious entries.

Patch Information

At the time of publication, no vendor patch reference is included in the enriched CVE data. Users should monitor the Cockpit CMS GitHub repository and the PoC repository for remediation guidance and updated releases.

Workarounds

Apply a strict Content Security Policy that disallows inline scripts (script-src 'self') on the Cockpit admin interface to limit payload execution.
Place Cockpit CMS behind a reverse proxy or WAF with XSS filtering enabled for request bodies and query parameters.
Limit content-authoring privileges to a minimal set of trusted accounts and enforce multi-factor authentication on administrator logins.
Rotate administrator session credentials and API tokens if compromise is suspected.

bash

# Example CSP header for the Cockpit admin interface (nginx)
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'" always;