CVE-2026-96739: SEMCMS KindEditor XSS Vulnerability

CVE-2026-96739 Overview

CVE-2026-96739 is a cross-site scripting (XSS) vulnerability in SEMCMS versions up to 4.2. The flaw resides in the /Edit/php/upload_json.php file within the KindEditor Upload Interface component. Attackers can manipulate the imgFile argument to inject malicious script content that executes in the context of a victim's browser.

The vulnerability is remotely exploitable and requires user interaction to trigger. A public exploit has been released. The vendor was contacted prior to disclosure but did not respond, leaving the issue unpatched at publication time.

Critical Impact
Remote attackers can inject arbitrary JavaScript into the application through the KindEditor upload endpoint, enabling session theft, phishing, and malicious actions performed in the context of authenticated users.

Affected Products

SEMCMS up to version 4.2
Component: KindEditor Upload Interface (/Edit/php/upload_json.php)
Parameter: imgFile

Discovery Timeline

2026-09-24 - CVE-2026-96739 published to the National Vulnerability Database (NVD)
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-96739

Vulnerability Analysis

The vulnerability is categorized as Cross-Site Scripting [CWE-79]. The affected endpoint /Edit/php/upload_json.php processes the imgFile request parameter without proper output encoding or input sanitization. An attacker who crafts a request containing JavaScript payloads in imgFile can cause the server to reflect that content back into a response rendered by the victim's browser.

Successful exploitation lets attackers execute arbitrary script in the victim's session. This enables cookie theft, credential harvesting through fake login overlays, forced browser actions, and pivoting to administrative functions when a privileged user is targeted. Because KindEditor is commonly embedded in administrator-facing content editors, the practical impact concentrates on CMS operators.

Root Cause

The root cause is missing input validation and output encoding on the imgFile parameter inside the KindEditor PHP upload handler. The handler accepts user-supplied input and incorporates it into a response without neutralizing HTML or JavaScript metacharacters, violating standard output-encoding practices for untrusted data.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker crafts a URL or form submission that targets /Edit/php/upload_json.php with a malicious imgFile value and lures a SEMCMS user (typically an administrator) into visiting it. When the victim loads the attacker-controlled request, the injected script executes under the SEMCMS origin.

See the GitHub Issue Discussion and the VulDB CVE Record for additional technical references.

Detection Methods for CVE-2026-96739

Indicators of Compromise

HTTP requests to /Edit/php/upload_json.php containing script tags, javascript: URIs, or event-handler attributes within the imgFile parameter.
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after visiting SEMCMS editor pages.
Web server access logs showing URL-encoded payloads such as %3Cscript%3E targeting the KindEditor endpoint.

Detection Strategies

Deploy web application firewall (WAF) signatures that inspect query and body parameters sent to /Edit/php/upload_json.php for XSS payload patterns.
Review PHP application logs for requests to the KindEditor upload interface that originate from unauthenticated or unusual source addresses.
Perform authenticated application scans against SEMCMS instances using DAST tooling tuned for reflected XSS in file upload endpoints.

Monitoring Recommendations

Monitor administrator session cookies for use from unexpected IP addresses or geolocations.
Alert on anomalous POST and GET volumes to /Edit/php/ paths, particularly those containing encoded HTML characters.
Correlate browser-generated requests with Content Security Policy (CSP) violation reports to surface attempted script injection.

How to Mitigate CVE-2026-96739

Immediate Actions Required

Restrict access to /Edit/php/upload_json.php to authenticated administrators and trusted source IP ranges using web server rules.
Deploy WAF rules that block script tags, event handlers, and javascript: schemes in the imgFile parameter.
Instruct SEMCMS administrators to avoid clicking untrusted links while authenticated to the CMS backend.

Patch Information

No vendor patch is available. The SEMCMS maintainers did not respond to disclosure attempts. Organizations should treat SEMCMS 4.2 and earlier as unpatched and apply compensating controls. Track updates through the VulDB Vulnerability Entry for any future advisories.

Workarounds

Implement a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Add server-side input validation to reject non-filename characters in the imgFile parameter and encode all reflected output as HTML entities.
Place SEMCMS administrative paths behind a VPN or reverse proxy that enforces authentication before requests reach the application.
Consider migrating to a maintained CMS platform if SEMCMS continues to receive no security updates.

bash

# Example nginx configuration restricting access to the vulnerable endpoint
location = /Edit/php/upload_json.php {
    allow 10.0.0.0/8;      # internal admin network
    deny all;
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'" always;
}