CVE-2026-71249 Overview
CVE-2026-71249 is a reflected Cross-Site Scripting (XSS) vulnerability in the 299Ko content management system's public contact form plugin. The flaw exists in plugin/contact/controllers/ContactController.php and its home() method, which writes raw POST field values into the page template without sanitization. Attackers can inject arbitrary JavaScript through the name, firstname, email, or message fields. The payload executes in the browser of any visitor who submits the form, including administrators tricked into auto-submitting a crafted request. This enables session token theft and account takeover [CWE-79].
Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in an administrator's browser session, enabling session hijacking and administrative account compromise.
Affected Products
- 299Ko content management system
- 299Ko Contact plugin (plugin/contact/)
- Deployments using the default common/Template.php template engine
Discovery Timeline
- 2026-08-05 - CVE-2026-71249 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-71249
Vulnerability Analysis
The vulnerability chains three unsafe behaviors across the 299Ko codebase. First, the home() method inside plugin/contact/controllers/ContactController.php reads POST parameters and assigns them to template variables without applying any input sanitization or output encoding. Second, the template engine's variable output routine _show_var() in common/Template.php echoes variable content directly without calling htmlspecialchars() or an equivalent encoding function. Third, the contact.tpl sink template renders these values inside an HTML attribute and a <textarea> element without contextual escaping. The result is a reflected XSS sink reachable by any unauthenticated visitor. User interaction is required because the payload executes only when the form is submitted, which attackers commonly automate through a crafted page that auto-submits the request against the target site.
Root Cause
The root cause is missing output encoding in the template engine combined with unsanitized controller inputs. The engine trusts the caller, the controller trusts the request, and the template trusts the engine, so no layer applies HTML context encoding.
Attack Vector
An attacker crafts a payload such as name="><script>alert(document.domain)</script> and delivers it through a link or an auto-submitting HTML form. When the victim's browser submits the request, the injected script executes in the origin of the vulnerable 299Ko installation. Because the scope is changed, the script can read cookies, exfiltrate session tokens, or perform authenticated actions as the victim.
No verified proof-of-concept code is publicly available. See the referenced repository search for source-level details of the vulnerable functions listed above.
Detection Methods for CVE-2026-71249
Indicators of Compromise
- POST requests to the contact plugin endpoint containing HTML control characters such as <, >, ", or script in the name, firstname, email, or message fields.
- Web server access logs showing external referrers directing users to /contact with pre-populated query parameters.
- Outbound requests from user browsers to attacker-controlled domains following a contact form submission, suggesting token exfiltration.
Detection Strategies
- Deploy a Web Application Firewall (WAF) rule that inspects contact form fields for HTML tag characters and known XSS payload signatures.
- Enable Content Security Policy (CSP) violation reporting to surface inline script execution attempts on pages rendering the contact form.
- Correlate administrator session anomalies, such as new IP addresses or user agents, with recent contact form submissions in web logs.
Monitoring Recommendations
- Monitor HTTP request bodies to plugin/contact/ endpoints for payloads containing angle brackets, event handler attributes, or javascript: URIs.
- Alert on administrator sessions initiated shortly after a contact form submission from an unauthenticated source.
- Track template rendering errors or unusual response sizes on contact.tpl that may indicate probing.
How to Mitigate CVE-2026-71249
Immediate Actions Required
- Disable the public contact plugin until a patched version is available if the form is not business-critical.
- Restrict administrative access to the 299Ko backend by IP allowlist to reduce the chance of an administrator triggering the sink.
- Deploy WAF rules that block HTML metacharacters in the name, firstname, email, and message POST parameters.
Patch Information
No vendor patch has been published in the referenced advisories at the time of writing. Administrators should monitor the 299Ko GitHub repository for updates and apply fixes that add htmlspecialchars() encoding inside common/Template.php_show_var() and input validation inside ContactController.phphome().
Workarounds
- Manually patch common/Template.php so that _show_var() wraps output with htmlspecialchars($value, ENT_QUOTES, 'UTF-8') before echoing.
- Add server-side input validation in ContactController.phphome() to reject or encode angle brackets and quotes in submitted fields.
- Set a strict Content Security Policy that disallows inline scripts on pages that render the contact form.
# Example strict CSP header to mitigate reflected XSS execution
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
