CVE-2026-93460: baserCMS Stored XSS Vulnerability

CVE-2026-93460 Overview

CVE-2026-93460 is a stored cross-site scripting (XSS) vulnerability in baserCMS, an open-source content management system. The flaw resides in the email form field handling, where appended strings are not properly sanitized before rendering. An authenticated attacker with low privileges can inject malicious script content that executes in the browser of any user who views the affected form output. This vulnerability is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Successful exploitation allows arbitrary JavaScript execution in the victim's browser session, enabling session theft, credential harvesting, or unauthorized actions performed as the targeted user.

Affected Products

baserCMS (specific versions not enumerated in the advisory)
Deployments exposing email form functionality
Instances where untrusted users can submit or configure email form fields

Discovery Timeline

2026-09-30 - CVE-2026-93460 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-93460

Vulnerability Analysis

The vulnerability exists in baserCMS email form field processing. Appended string values submitted through the form are stored and later rendered in a web context without adequate output encoding. When a victim loads a page containing the malicious payload, the injected script executes with the origin and session of the victim.

Because the payload is persisted server-side, every subsequent visitor to the affected view is exposed. This distinguishes stored XSS from reflected variants and increases the potential blast radius across administrative and end-user interfaces.

The attacker requires low-level authenticated access to submit the payload. Exploitation depends on victim interaction, typically loading the page that renders the tainted content.

Root Cause

The root cause is missing or insufficient output encoding when rendering user-supplied strings appended to email form fields. baserCMS emits stored input into HTML context without neutralizing characters such as <, >, and quote delimiters, allowing HTML and script tags to be interpreted by the browser.

Attack Vector

An attacker submits crafted input containing HTML or JavaScript through the vulnerable email form field. The application stores the value and later renders it in an administrative or public page. When any authenticated or unauthenticated user visits that page, the browser parses and executes the attacker-controlled script.

No verified proof-of-concept code is publicly available. Refer to the baserCMS Security Advisory and the JVN Security Vulnerability Report for vendor-provided technical detail.

Detection Methods for CVE-2026-93460

Indicators of Compromise

Stored form field values containing HTML tags such as <script>, <img onerror=, or <svg onload=
Outbound requests from browsers to unfamiliar domains shortly after loading baserCMS pages that render email form data
Unexpected session token or cookie exfiltration events tied to administrative accounts

Detection Strategies

Audit the baserCMS database tables that persist email form submissions for records containing HTML control characters or script keywords
Review web server access logs for POST requests to email form endpoints with payloads containing encoded script fragments
Deploy a Content Security Policy (CSP) report-only header to surface script execution attempts from unexpected sources

Monitoring Recommendations

Enable application-layer logging for form submissions and administrative page renders
Monitor for anomalous JavaScript execution and DOM modifications on baserCMS administrative interfaces
Alert on repeated failed authentication attempts followed by successful logins to accounts with form-editing privileges

How to Mitigate CVE-2026-93460

Immediate Actions Required

Apply the security update referenced in the baserCMS Security Advisory as soon as it is available for your version
Restrict access to email form configuration to trusted administrative users only
Review existing email form records for stored payloads and sanitize or remove malicious content

Patch Information

Refer to the baserCMS Security Advisory and the JVN Security Vulnerability Report for vendor-supplied patched versions and upgrade guidance. Verify the fixed release against your deployed baserCMS version before applying in production.

Workarounds

Enforce a strict Content Security Policy that disallows inline script execution on pages rendering user-submitted form data
Place baserCMS administrative endpoints behind a web application firewall (WAF) with rules that block HTML and script tags in form field parameters
Temporarily disable the affected email form functionality if patching is not immediately feasible

bash

# Example restrictive CSP header for baserCMS deployments
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'