CVE-2026-90497: Feng Office XSS Vulnerability

CVE-2026-90497 Overview

CVE-2026-90497 is a cross-site scripting (XSS) vulnerability [CWE-79] affecting Fengoffice Feng Office versions up to and including 3.11.13.11. The flaw resides in the getTitle function within application/views/task/add_task.php, part of the Task Title Output component. An authenticated attacker can manipulate the og_objects.name argument to inject script content that executes in a victim's browser. The exploit has been publicly disclosed. The vendor was contacted about the disclosure but did not respond.

Critical Impact
Authenticated attackers can inject persistent script payloads through task titles, enabling session token theft, unauthorized actions in a victim's context, and browser-based phishing against Feng Office users.

Affected Products

Fengoffice Feng Office versions up to 3.11.13.11
application/views/task/add_task.php (Task Title Output component)
getTitle function processing og_objects.name

Discovery Timeline

2026-09-13 - CVE-2026-90497 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90497

Vulnerability Analysis

The vulnerability exists in the Task Title Output component of Feng Office, a web-based collaboration and project management platform. The getTitle function in application/views/task/add_task.php renders the og_objects.name value into the HTML response without proper output encoding. When a user creates or edits a task with a crafted title, the payload is stored and later reflected to any user viewing that task. The attack originates over the network and requires user interaction to trigger the injected script. Successful exploitation impacts the integrity of the rendered page but does not directly affect confidentiality or availability of server-side resources.

Root Cause

The root cause is missing or insufficient output sanitization in the getTitle function. User-supplied data flowing through og_objects.name is emitted into an HTML context without escaping characters such as <, >, ", and '. Feng Office does not apply a context-aware encoding routine before returning the task title to the browser, allowing HTML and JavaScript to be interpreted as active content.

Attack Vector

An attacker with low-privilege authenticated access creates a task whose title contains a JavaScript payload embedded within HTML tags or event handlers. The payload is stored by the application and served to any authenticated user who views the affected task view. Execution occurs in the victim's session context, enabling theft of session cookies, forgery of application requests, and delivery of secondary payloads. Public disclosure of the exploit lowers the barrier for opportunistic attacks against exposed Feng Office deployments.

No verified proof-of-concept code has been published in a form suitable for reproduction here. See the VulDB entry for CVE-2026-90497 for technical details.

Detection Methods for CVE-2026-90497

Indicators of Compromise

Task titles or og_objects.name values containing HTML tags such as <script>, <img onerror=...>, or <svg onload=...>.
Outbound requests from user browsers to unfamiliar domains shortly after opening a Feng Office task view.
Unexpected session activity or actions performed by accounts that recently viewed shared task lists.

Detection Strategies

Inspect the Feng Office database og_objects table for name fields containing angle brackets, javascript: URIs, or common XSS payload markers.
Review web server access logs for POST requests to task creation and edit endpoints carrying suspicious name parameters.
Deploy web application firewall rules that flag script-like content submitted to Feng Office task endpoints.

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to capture attempted script executions from unauthorized sources.
Correlate authenticated user activity with task modification events to identify accounts creating obfuscated titles.
Monitor for anomalous administrative actions performed shortly after a user viewed a task modified by a lower-privileged account.

How to Mitigate CVE-2026-90497

Immediate Actions Required

Restrict access to Feng Office instances to trusted networks or place them behind an authenticated reverse proxy until a fix is available.
Audit existing task titles for stored payloads and sanitize or remove malicious entries from the og_objects table.
Reduce privileges for accounts that do not require task creation or editing capabilities.

Patch Information

No vendor patch is available. According to the disclosure, Fengoffice was contacted but did not respond. Organizations should track the VulDB advisory for updates and evaluate the risk of continued exposure while no official fix exists.

Workarounds

Deploy a web application firewall rule set that blocks HTML and JavaScript metacharacters in Feng Office task creation and edit parameters.
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Apply short-lived session cookies with the HttpOnly and SameSite=Strict attributes to reduce the impact of stolen session tokens.
If feasible, apply a local patch to application/views/task/add_task.php that HTML-encodes og_objects.name before output.

bash

# Example nginx configuration to enforce a strict CSP for Feng Office
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;