CVE-2021-25977 Piranha CMS - Stored XSS in Page Title

Medium 5.4 Published 25 Oct 2021 Updated 30 Apr 2025

A low-privileged user can execute arbitrary JavaScript via stored XSS in the page title field of Piranha CMS.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2021-25977?

CVE-2021-25977 is a medium-severity cross-site scripting vulnerability in PiranhaCMS Piranha, published on 25 Oct 2021. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

In PiranhaCMS, versions 7.0.0 to 9.1.1 are vulnerable to stored XSS due to the page title improperly sanitized. By creating a page with a specially crafted page title, a low privileged user can trigger arbitrary JavaScript execution.

Weakness: CWE-79

Which versions are affected by CVE-2021-25977?

2 open source packages ship an affected version, including Piranha. It affects 1 product.

Package	Affected	Fixed in
`Piranha` NuGet	From `7.0.0`	`9.2.0`
`Piranha` NuGet	From `7.0.0`	`9.2.0`

Products include Dotnetfoundation Piranha Cms.

How do I fix CVE-2021-25977?

Upgrade Piranha to 9.2.0 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2021-25977 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-25977 exists.

Sources

Also known as GHSA-jvjp-vh27-r9h5.