CVE-2026-51565: Milk Admin XSS Vulnerability

CVE-2026-51565 Overview

CVE-2026-51565 is a reflected cross-site scripting (XSS) vulnerability affecting Milk admin version 0.9.8 and earlier. The flaw resides in Modules/Docs/DocsController.php, where the action parameter is rendered without proper sanitization or output encoding. Remote attackers can craft a request containing arbitrary HTML or JavaScript that executes in the victim's browser session when the malicious URL is visited. The issue is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation. Successful exploitation requires user interaction but no authentication.

Critical Impact
Attackers can hijack authenticated administrator sessions, steal credentials, and perform actions on behalf of the victim within the Milk admin interface.

Affected Products

Milk admin (giuliopanda/milk-admin) versions <= 0.9.8
Component: Modules/Docs/DocsController.php
Attack surface: action HTTP parameter

Discovery Timeline

2026-07-27 - CVE-2026-51565 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-51565

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the Docs module of the Milk admin PHP application. The DocsController.php handler accepts an action query parameter and reflects its value into the HTTP response without applying HTML entity encoding or contextual output escaping. When a victim loads a crafted URL, the injected script executes under the origin of the Milk admin site. This scope change (indicated by the CVSS S:C component) allows attacks to reach content beyond the immediately vulnerable component, such as browser-stored session tokens or cookies used across the admin interface.

Root Cause

The root cause is the absence of input validation and output encoding on the action parameter processed by DocsController.php. User-supplied input flows directly into the rendered HTML response. PHP applications must apply htmlspecialchars() or equivalent context-aware encoding before echoing untrusted data. The Milk admin controller omits this step, allowing raw markup and script tags to reach the DOM.

Attack Vector

Exploitation is network-based and requires the victim to click a crafted link or visit an attacker-controlled page that triggers navigation to the vulnerable endpoint. An attacker constructs a URL such as /index.php?module=Docs&action=<script>...</script> and delivers it via phishing, forum posts, or malicious redirects. When an authenticated administrator loads the URL, the payload executes in their browser context. Because Milk admin is an administrative panel, harvested session material typically grants privileged access.

A proof-of-concept for this issue is published at the GitHub PoC Repository. The vulnerable source is available at the Milk admin project repository and specifically in the DocsController.php source file.

Detection Methods for CVE-2026-51565

Indicators of Compromise

HTTP requests to Milk admin endpoints where the action parameter contains <script>, javascript:, onerror=, onload=, or URL-encoded equivalents such as %3Cscript%3E.
Web server access logs showing anomalous referrers directing users to Modules/Docs endpoints with encoded HTML in query strings.
Browser telemetry or CSP violation reports originating from the Milk admin origin that reference inline script execution.

Detection Strategies

Deploy web application firewall (WAF) rules that flag HTML tags and JavaScript event handlers appearing in the action query parameter.
Enable Content Security Policy (CSP) with report-uri or report-to directives to capture blocked inline script attempts.
Review historical proxy and reverse-proxy logs for requests matching the exploitation pattern documented in the public PoC.

Monitoring Recommendations

Alert on outbound requests from administrator browsers to unknown hosts shortly after visits to Milk admin pages, which may indicate cookie exfiltration.
Monitor administrator session creation from unexpected IP addresses or user-agents following XSS delivery.
Correlate email gateway telemetry with web proxy logs to identify phishing links pointing at Milk admin instances.

How to Mitigate CVE-2026-51565

Immediate Actions Required

Restrict access to the Milk admin interface to trusted networks or VPN-only reachability until a patched version is deployed.
Instruct administrators to avoid clicking links to the Milk admin panel received via email, chat, or external referrers.
Rotate any administrator session cookies and credentials that may have been exposed if suspicious traffic is observed.

Patch Information

At the time of publication, no vendor advisory or fixed release is referenced in the NVD entry. Monitor the Milk admin project repository for a version newer than 0.9.8 that adds output encoding to Modules/Docs/DocsController.php. Apply the update as soon as it becomes available.

Workarounds

Deploy a WAF rule that rejects requests where the action parameter contains HTML tags, JavaScript event handlers, or URL-encoded script markup.
Enforce a strict Content Security Policy that disallows inline scripts (script-src 'self') to neutralize reflected payloads.
Set the HttpOnly and Secure flags on Milk admin session cookies and enable SameSite=Strict to reduce session theft impact.
If the Docs module is not required, disable or remove the module from the deployment until a fix is available.

bash

# Example ModSecurity rule to block HTML/JS injection in the 'action' parameter
SecRule ARGS:action "@rx (?i)(<script|onerror=|onload=|javascript:|%3Cscript)" \
    "id:1005165,phase:2,deny,status:403,log,msg:'CVE-2026-51565 XSS attempt in Milk admin action parameter'"