CVE-2026-81635: SHIRASAGI CMS XSS Vulnerability

CVE-2026-81635 Overview

CVE-2026-81635 is a cross-site scripting (XSS) vulnerability [CWE-79] in SHIRASAGI, an open-source content management system developed by SS-Proj. An attacker can inject arbitrary script that executes in the browser of a user who visits a website served by the affected product. Successful exploitation requires that the target user interact with attacker-controlled content, and the attacker must hold low-level privileges on the application. The scope is limited to confidentiality and integrity impact on subsequent components rather than the vulnerable application itself.

Critical Impact
Arbitrary script execution in the context of a victim's browser session, enabling content manipulation and limited data exposure across downstream components.

Affected Products

SHIRASAGI content management system
Deployments maintained by SS-Proj
Refer to SS-Proj Support Document #1710 for exact affected versions

Discovery Timeline

2026-09-10 - CVE-2026-81635 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-81635

Vulnerability Analysis

The vulnerability is a stored or reflected cross-site scripting flaw in SHIRASAGI. The application fails to properly neutralize user-supplied input before rendering it within web pages. As a result, attacker-controlled markup or JavaScript reaches the browser as executable content.

Exploitation is network-based and requires user interaction, such as clicking a crafted link or viewing an attacker-influenced page. An authenticated attacker with low privileges can inject payloads that execute in the context of another user's session. Impact extends to subsequent components rather than the SHIRASAGI application itself, allowing tampering with rendered content or theft of data accessible from the victim's browser.

Refer to JVN Security Advisory JVN37476837 and SS-Proj Support Document #1710 for the vendor-supplied technical description.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. SHIRASAGI accepts user input through one or more input fields and reflects that data into HTML output without adequate contextual encoding. Browsers then parse the injected sequence as active script rather than inert text.

Attack Vector

An attacker delivers a crafted payload through an input field or URL parameter accepted by SHIRASAGI. When a victim views the resulting page, the injected script executes with the victim's browser privileges. The attack requires the attacker to hold low-level application privileges and requires user interaction from the target. No verified public proof-of-concept code has been published at the time of writing. Consult the vendor advisory for concrete payload contexts.

Detection Methods for CVE-2026-81635

Indicators of Compromise

HTTP request or response bodies containing <script>, javascript:, onerror=, or onload= sequences submitted to SHIRASAGI endpoints
Stored CMS content records containing unexpected HTML event handler attributes or inline script tags
Outbound browser requests from authenticated SHIRASAGI sessions to unfamiliar external domains shortly after page render

Detection Strategies

Inspect application logs for POST or PUT requests to SHIRASAGI content endpoints containing HTML tags or JavaScript keywords in request parameters
Deploy a Web Application Firewall rule set that flags XSS payload patterns targeting SHIRASAGI URL paths
Perform periodic content integrity scans of stored SHIRASAGI records to identify rendered fields containing script elements

Monitoring Recommendations

Alert on Content Security Policy (CSP) violation reports originating from SHIRASAGI-served pages
Correlate authenticated editor or contributor account activity with unusual content edits containing HTML markup
Monitor administrator session behavior for anomalous DOM interactions or credential submissions following content views

How to Mitigate CVE-2026-81635

Immediate Actions Required

Apply the SHIRASAGI security update referenced in SS-Proj Support Document #1710 as soon as it becomes available for your deployment
Restrict content authoring privileges to trusted accounts and review recent content changes made by low-privileged users
Enforce a strict Content Security Policy that blocks inline scripts and untrusted script sources on SHIRASAGI-hosted pages

Patch Information

Refer to SS-Proj Support Document #1710 and JVN Security Advisory JVN37476837 for vendor-provided patch details, fixed version numbers, and upgrade instructions. Fixed version identifiers are not enumerated in the NVD entry.

Workarounds

Place SHIRASAGI behind a Web Application Firewall configured with XSS payload filtering until the patch is applied
Configure the browser-facing HTTP response to include Content-Security-Policy, X-Content-Type-Options: nosniff, and X-XSS-Protection headers
Reduce the set of accounts granted content-editing roles and require multi-factor authentication for those accounts

bash

# Example Content-Security-Policy header applied at the reverse proxy
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'" always;
add_header X-Content-Type-Options "nosniff" always;