CVE-2026-96810: huanzi-qch base-admin XSS Vulnerability

CVE-2026-96810 Overview

CVE-2026-96810 is a stored cross-site scripting (XSS) vulnerability in the huanzi-qch base-admin project. The flaw resides in the Save function of base-admin-master\src\main\java\cn\huanzi\qch\baseadmin\common\controller\CommonController.java, within the Add User Handler component. Attackers manipulate the Username argument to inject arbitrary script content that executes in the browser of any user who later views the stored data. The project uses continuous delivery with rolling releases, so no fixed or affected version numbers are published. According to the advisory, the vendor was contacted prior to disclosure but did not respond.

Critical Impact
Remote attackers with low privileges can store malicious scripts through the Add User form, enabling session hijacking, credential theft, and administrative action abuse when administrators view affected pages.

Affected Products

huanzi-qch base-admin up to commit 52816b760cd53244989fd664bbb2b3d4edbfdbf1
Component: Add User Handler (CommonController.java)
Function: Save

Discovery Timeline

2026-09-24 - CVE-2026-96810 published to the National Vulnerability Database (NVD)
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-96810

Vulnerability Analysis

The vulnerability is a stored (persistent) cross-site scripting flaw classified under CWE-79: Improper Neutralization of Input During Web Page Generation. The Save function in CommonController.java accepts a Username parameter from the Add User Handler without proper sanitization or output encoding. Supplied script payloads persist in the application's data store and execute whenever another user renders a page containing the stored value.

Exploitation requires network access to the application and a low-privileged account that can submit the Add User form. A second user, typically an administrator reviewing user records, must interact with the affected page to trigger script execution. Successful exploitation can lead to session token theft, forced actions in the victim's authenticated context, and defacement of administrative views. Public exploit information has been referenced in the GitHub Security Vulnerability Guide.

Root Cause

The root cause is missing input validation and output encoding on the Username field processed by the Save function. The controller writes attacker-controlled text into persistent storage and later renders it into HTML responses without contextual escaping. Because base-admin uses rolling releases, no explicit patched build identifier is available.

Attack Vector

An attacker authenticates with a low-privileged account and submits a crafted Username value containing HTML or JavaScript through the Add User interface. The payload is stored server-side. When a privileged user, such as an administrator, loads a list or detail view that renders the stored username, the browser executes the injected script in that user's session context. See the VulDB CVE-2026-96810 Details record for additional context on the attack flow.

No verified proof-of-concept code is reproduced here. Refer to the GitHub Security Vulnerability Guide and the VulDB Vulnerability Report #409062 for technical details.

Detection Methods for CVE-2026-96810

Indicators of Compromise

Stored Username field values containing HTML or JavaScript syntax such as <script>, onerror=, onload=, or encoded variants like %3Cscript%3E.
Unexpected outbound requests from administrator browsers to attacker-controlled domains after loading user management pages.
Audit log entries showing Add User submissions originating from low-privileged accounts with abnormally long or structured Username values.

Detection Strategies

Inspect HTTP request bodies to the Save endpoint in CommonController.java for payloads containing script tags, event handler attributes, or JavaScript URI schemes.
Review database records in user tables for stored entries containing HTML control characters that were not escaped at insertion time.
Deploy content security policy (CSP) violation reporting to surface script executions originating from unexpected inline sources.

Monitoring Recommendations

Enable web application firewall (WAF) rules that flag XSS payload patterns submitted to base-admin user management endpoints.
Correlate administrative session anomalies, such as unusual API calls shortly after loading user list pages, with recent Add User submissions.
Monitor browser telemetry from administrator workstations for unexpected script execution and cross-origin requests.

How to Mitigate CVE-2026-96810

Immediate Actions Required

Restrict access to the Add User Handler to trusted administrator accounts until the application is remediated.
Audit the user table for stored values containing HTML or script content and sanitize or remove suspicious entries.
Deploy a WAF rule to block requests to the Save endpoint containing XSS payload patterns in the Username parameter.

Patch Information

The vendor has not responded to disclosure, and no official patch identifier is available. Because base-admin uses continuous delivery with rolling releases, operators should track the upstream repository and apply the latest commit that introduces server-side input validation and output encoding for the Username field. Consult the VulDB CVE-2026-96810 Details page for ongoing remediation guidance.

Workarounds

Implement a reverse proxy filter that strips or encodes HTML metacharacters (<, >, ", ', &) in the Username parameter before requests reach the application.
Apply a strict Content Security Policy that disallows inline scripts and limits script sources to trusted origins to reduce exploitation impact.
Enforce contextual output encoding in any custom templates or views that render user-supplied fields from base-admin.

bash

# Example nginx reverse proxy rule to block script-like payloads in Username
location /common/save {
    if ($arg_Username ~* "(<|%3C)\s*script|on\w+\s*=|javascript:" ) {
        return 403;
    }
    proxy_pass http://base-admin-backend;
}