CVE-2026-93464: baserCMS Stored XSS Vulnerability

CVE-2026-93464 Overview

CVE-2026-93464 is a stored Cross-Site Scripting (XSS) vulnerability in baserCMS, an open-source Japanese content management system. The flaw resides in the handling of custom content descriptions, where user-supplied input is stored and later rendered without adequate sanitization. An authenticated attacker with content editing privileges can inject arbitrary JavaScript that executes in the browser of any user who views the affected content. The issue is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Successful exploitation allows arbitrary script execution in a victim's browser session, enabling session hijacking, credential theft, and unauthorized actions performed on behalf of the victim.

Affected Products

baserCMS (custom content description functionality)
Refer to the baserCMS Security Advisory JVN_14353754 for affected version ranges
See the JVN Security Advisory JVN14353754 for coordinated disclosure details

Discovery Timeline

2026-09-30 - CVE-2026-93464 published to the National Vulnerability Database (NVD)
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-93464

Vulnerability Analysis

The vulnerability is a stored (persistent) XSS flaw in baserCMS. When a user with content management privileges submits a custom content description, the application persists the raw input in its data store. When another user, typically an administrator or site visitor, later renders the page containing that description, the browser interprets embedded HTML and JavaScript as executable content. The attack requires user interaction because the payload only fires when a victim loads the affected page.

Because the payload persists server-side, a single injection can affect every user who views the compromised content. This amplifies the impact compared to reflected XSS, which requires per-victim delivery. The vulnerability affects both the confidentiality and integrity of subsequent components accessed through the victim's browser context.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. baserCMS fails to encode or sanitize HTML control characters in the custom content description field before writing them into the rendered page. Standard defenses such as output encoding of <, >, ", ', and &, or a strict allowlist HTML sanitizer, were not applied to this field.

Attack Vector

An authenticated attacker with permission to edit content submits a description containing an HTML or JavaScript payload through the baserCMS administration interface. The payload is stored in the backend database. When a legitimate user, often an administrator with higher privileges, navigates to the page that renders this description, the injected script executes in the victim's session context. Attacker capabilities include reading session cookies not marked HttpOnly, invoking authenticated administrative endpoints, defacing content, and redirecting users to attacker-controlled infrastructure.

No verified public exploit code is available for CVE-2026-93464. See the baserCMS Security Advisory JVN_14353754 for vendor-provided technical detail.

Detection Methods for CVE-2026-93464

Indicators of Compromise

Content description fields containing HTML tags such as <script>, <img onerror=...>, <svg onload=...>, or javascript: URIs.
Unexpected outbound HTTP requests originating from browsers of administrators shortly after they viewed baserCMS content pages.
New or modified administrator accounts, or session tokens used from unusual IP addresses following content edits.
Audit log entries showing content edits by low-privilege accounts followed by administrator access to those pages.

Detection Strategies

Query the baserCMS database for stored content descriptions containing script tags, event handler attributes (onerror, onload, onclick), or encoded variants such as <script.
Deploy Content Security Policy (CSP) violation reporting and monitor report-uri endpoints for inline script violations originating from baserCMS pages.
Inspect web server access logs for POST requests to content editing endpoints followed by GET requests from administrator sessions that trigger unusual JavaScript activity.

Monitoring Recommendations

Forward baserCMS application logs and web server logs to a centralized analytics platform and alert on content edits by non-administrative accounts.
Monitor administrator session activity for anomalous API calls immediately following content page loads.
Enable browser-side integrity monitoring, such as Subresource Integrity (SRI) and CSP with script-src restrictions, and alert on violation reports.

How to Mitigate CVE-2026-93464

Immediate Actions Required

Apply the vendor-supplied baserCMS security update referenced in the baserCMS Security Advisory JVN_14353754 as soon as it is available in your environment.
Audit existing custom content descriptions for injected HTML or JavaScript and sanitize or remove suspicious entries.
Rotate administrator session tokens and passwords if evidence of stored payload execution exists.
Restrict content editing privileges to trusted accounts and enforce multi-factor authentication for administrative access.

Patch Information

Refer to the baserCMS Security Advisory JVN_14353754 and the JVN Security Advisory JVN14353754 for fixed version details and upgrade instructions. Apply the patched release across all baserCMS installations.

Workarounds

Enforce a strict Content Security Policy that disallows inline scripts and restricts script-src to trusted origins.
Deploy a Web Application Firewall (WAF) rule that blocks HTML tags and event handler attributes submitted to baserCMS content editing endpoints.
Limit access to the baserCMS administration interface by source IP address using network-level controls until the patch is deployed.

bash

# Example nginx Content Security Policy header for baserCMS
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; report-uri /csp-report" always;