CVE-2026-41147: NukeViet CMS Stored XSS Vulnerability

CVE-2026-41147 Overview

CVE-2026-41147 is a stored Cross-Site Scripting (XSS) vulnerability in NukeViet CMS versions 4.5.07 and prior. The flaw resides in the Request class, which relies primarily on client-side filtering to sanitize HTML tags and attributes in user-submitted content. Attackers can bypass this control by intercepting and modifying HTTP requests with tools such as Burp Suite. Any anonymous visitor can inject malicious payloads that persist server-side and execute in the browser of any user viewing the content, including administrators and moderators. The Contact module serves as a documented proof-of-concept entry point. The issue has been fixed in version 4.5.08.

Critical Impact
Unauthenticated attackers can store JavaScript payloads that execute against administrators, enabling session hijacking, unauthorized actions, defacement, and phishing through manipulated email notifications.

Affected Products

NukeViet CMS versions 4.5.07 and prior
NukeViet CMS Contact module (proof-of-concept vector)
NukeViet CMS Request class input handling component

Discovery Timeline

2026-05-22 - CVE-2026-41147 published to NVD
2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-41147

Vulnerability Analysis

The vulnerability is a stored Cross-Site Scripting flaw classified under [CWE-79]. NukeViet CMS performs HTML tag and attribute sanitization on the client side rather than enforcing equivalent validation on the server. When user-submitted content reaches the server, the Request class accepts the data without stripping or encoding dangerous markup. The payload is persisted to the database and rendered in subsequent page views.

Exploitation requires no authentication. Any anonymous visitor can submit content through the Contact module, comments, or similar input surfaces. When an administrator or moderator opens the affected view, the stored script executes within their authenticated session context. The scope change is reflected in the CVSS vector with S:C, indicating the impact extends beyond the vulnerable component to the victim's browser session.

Root Cause

The root cause is insufficient server-side input sanitization in the Request class. The application trusts client-side JavaScript filters to remove dangerous HTML constructs such as <iframe>, srcdoc attributes, and inline event handlers including onerror and onload. Because client-side controls operate before the request is transmitted, attackers can disable or bypass them entirely by sending crafted requests directly to the server.

Attack Vector

An attacker intercepts a legitimate request to a user-input endpoint such as the Contact module submission handler. The attacker modifies the payload to include malicious HTML or JavaScript, for example an <iframe srcdoc="..."> element or a tag carrying an onerror handler. The server stores the payload unchanged. When a privileged user later reviews the submitted content in the administrative interface, the browser parses and executes the injected script. Common outcomes include theft of session cookies, forced administrative actions, page defacement, and redirection to phishing infrastructure.

The vulnerability is described in prose only; refer to the GitHub Security Advisory GHSA-64rr-pp78-62ww and the GitHub Commit Details for the patch implementation.

Detection Methods for CVE-2026-41147

Indicators of Compromise

Stored content containing <iframe>, <script>, srcdoc, or inline event handler attributes such as onerror, onload, onclick in database tables backing the Contact module, comments, or other user input modules.
Outbound requests from administrator browser sessions to unfamiliar domains shortly after viewing user-submitted content.
Unexpected session cookie values appearing in web server access logs or third-party telemetry.
Administrative actions originating from administrator accounts at times inconsistent with normal activity.

Detection Strategies

Audit stored user-submitted content for HTML tags and attributes that should not appear in plain-text submissions.
Inspect HTTP request bodies for payloads containing script tags or event handler attributes that bypassed client-side filtering.
Compare the running NukeViet version against the fixed release 4.5.08 to identify exposed instances.
Review Content Security Policy violation reports for inline script execution attempts inside administrative views.

Monitoring Recommendations

Enable CSP report-only mode to capture inline script attempts before enforcement.
Log and alert on administrator session activity that diverges from normal patterns, including new IP addresses or user-agent strings.
Monitor egress traffic from administrator workstations to detect cookie exfiltration attempts.

How to Mitigate CVE-2026-41147

Immediate Actions Required

Upgrade NukeViet CMS to version 4.5.08 or later, which contains the official fix.
Invalidate active administrator and moderator sessions and force credential rotation after upgrade.
Review and purge stored user-submitted content for malicious payloads introduced before patching.

Patch Information

The vendor released the fix in NukeViet GitHub Release 4.5.08. The corrective changes are documented in the upstream commit referenced in the GitHub Commit Details. The patch introduces server-side sanitization in the Request class so that dangerous tags and attributes are stripped or encoded before storage.

Workarounds

Implement server-side HTML sanitization in the Request class to strip or encode <iframe>, srcdoc, and event handler attributes such as onerror and onload.
Enforce a Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Set session cookies with the HttpOnly flag to prevent JavaScript access and reduce the impact of cookie theft.
Restrict access to administrative interfaces by IP allowlist where operationally feasible.

bash

# Example Content-Security-Policy and cookie hardening headers
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'none'"
Header edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure;SameSite=Strict