CVE-2026-67617: Microweber CMS Stored XSS Vulnerability

CVE-2026-67617 Overview

CVE-2026-67617 is a stored cross-site scripting (XSS) vulnerability [CWE-79] affecting Microweber CMS through version 2.0.20. The flaw resides in the content tagging system, where the tag_names parameter of the GET /api/save_content_admin endpoint fails to properly sanitize input. Admin-authenticated attackers can inject arbitrary JavaScript that executes for every visitor to the public blog page and within the admin post editor. The vulnerability bypasses three independent sanitization controls, enabling session riding through same-origin fetch requests using the CSRF token embedded in the page.

Critical Impact
Stored JavaScript executes without user interaction on public blog pages, allowing attackers to hijack admin sessions and perform authenticated actions using embedded CSRF tokens.

Affected Products

Microweber CMS versions through 2.0.20
Public-facing blog rendering pages
Admin post editor interface

Discovery Timeline

2026-08-03 - CVE-2026-67617 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-67617

Vulnerability Analysis

The vulnerability stems from a defense-in-depth failure across three sanitization layers in Microweber CMS. Each control was designed to prevent XSS injection, yet each contains an exploitable gap. Attackers with admin authentication can chain these gaps to persist JavaScript payloads in stored content tags.

Once injected, the malicious script renders both in the public blog view and inside the admin post editor. Execution occurs without user interaction on page load. Because the script runs in the same origin as the application, it can extract the CSRF token from the page and issue authenticated requests through the fetch API.

Root Cause

Three independent sanitization controls fail to block the injected payload. The XSS middleware explicitly ignores GET requests, so payloads delivered via GET /api/save_content_admin are never inspected. The strip_unsafe() function matches only double-quoted onerror attributes, allowing single-quoted or unquoted variants to pass. The titlecase normalizer accepts HTML decimal entity-encoded payloads without decoding and re-checking them, forwarding the encoded strings to storage unchanged.

Attack Vector

An authenticated administrator submits a crafted tag_names value containing an HTML decimal entity-encoded JavaScript payload to the GET /api/save_content_admin endpoint. The payload is stored in the content tagging system and rendered in the resulting HTML. When any visitor loads the affected blog page, the browser decodes the entities, parses the injected element, and executes the attacker's script in the visitor's session context. See the VulnCheck Security Advisory and the GitHub PoC Repository for technical details.

Detection Methods for CVE-2026-67617

Indicators of Compromise

Requests to GET /api/save_content_admin containing HTML decimal entity sequences (e.g., <, >, ') within the tag_names parameter
Stored content tags containing HTML tags, event handler attributes, or javascript: URIs
Unexpected outbound fetch requests originating from blog pages to attacker-controlled hosts

Detection Strategies

Inspect web server access logs for GET requests to /api/save_content_admin where the tag_names parameter contains angle brackets, entity encodings, or script-related keywords
Query the content tags table for entries containing <, >, &#, onerror, onload, or <script substrings
Baseline expected tag content length and character sets, then alert on outliers

Monitoring Recommendations

Enable web application firewall (WAF) logging on admin API endpoints and forward events to a central analytics platform
Monitor admin session activity for anomalous CSRF-authenticated requests that follow blog page loads
Review browser-side Content Security Policy (CSP) violation reports for blocked inline script execution attempts

How to Mitigate CVE-2026-67617

Immediate Actions Required

Restrict access to the Microweber admin interface using network-level controls or VPN until a patched version is deployed
Audit existing content tags for stored payloads and purge entries containing HTML markup or entity-encoded sequences
Rotate admin credentials and CSRF tokens for any account that may have interacted with malicious tags

Patch Information

No vendor patch is referenced in the enriched CVE data at time of writing. Monitor the VulnCheck Security Advisory and the Microweber project for an updated release beyond version 2.0.20 that addresses the tag_names sanitization gaps.

Workarounds

Deploy a WAF rule that blocks GET requests to /api/save_content_admin when the tag_names parameter contains <, >, or &# sequences
Extend the XSS middleware to inspect GET request parameters in addition to POST bodies
Implement a strict Content Security Policy that disallows inline scripts on public blog pages and the admin editor
Decode HTML entities before applying the strip_unsafe() function and expand its regex to match single-quoted and unquoted event handler attributes

bash

# Example WAF rule (ModSecurity syntax)
SecRule REQUEST_URI "@streq /api/save_content_admin" \
    "id:1006761,phase:2,deny,status:403,\
    chain,msg:'Blocked potential XSS in tag_names parameter'"
    SecRule ARGS:tag_names "@rx (<|>|&#[0-9]+;|on[a-z]+\s*=)" \
        "t:none,t:lowercase"