CVE-2026-32278 Connect CMS has Stored Cross-site Scripting (XSS) in the File Field of its Form Plugin
Attackers can inject malicious scripts via the Form Plugin's file field, potentially leading to session hijacking or code execution in Connect CMS.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-32278?
CVE-2026-32278 is a high-severity cross-site scripting vulnerability in opensource-workshop connect-cms, published on 23 Mar 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the 2.x series up to and including 2.41.0, a Stored Cross-site Scripting (XSS) issue exists in the file field of the Form Plugin. Versions 1.41.1 and 2.41.1 contain a patch.
Which versions are affected by CVE-2026-32278?
4 open source packages ship an affected version, including opensource-workshop/connect-cms. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
opensource-workshop/connect-cms Packagist | All versions | 1.41.1 |
opensource-workshop/connect-cms Packagist | All versions | 1.41.1 |
opensource-workshop/connect-cms Packagist | From 2.0.0 | 2.41.1 |
opensource-workshop/connect-cms Packagist | From 2.0.0 | 2.41.1 |
Products include Opensource-Workshop Connect-Cms.
How do I fix CVE-2026-32278?
Upgrade opensource-workshop/connect-cms to a fixed version for your release line: 1.41.1 or 2.41.1.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-32278 being exploited?
There is no known exploitation of CVE-2026-32278 in the wild and no public exploit code.
Other vulnerabilities in opensource-workshop connect-cms
- CVE-2026-32276 Connect-CMS has Arbitrary Code Execution by an Authenticated User in its Code Study Plugin
- CVE-2026-32277 Connect-CMS has DOM-based Cross-Site Scripting (XSS) in the Cabinet Plugin List View
- CVE-2026-32300 Connect CMS: Improper Authorization in the My Page Profile Update Feature Allows Modification of Arbitrary User Information
- CVE-2026-32299 Connect CMS: Information Disclosure Due to Improper Authorization through the Page Content Retrieval Feature
- CVE-2026-32279 Connect CMS has SSRF in the External Page Migration Feature of its Page Management Plugin
Sources
Also known as GHSA-mv3p-7p89-wq9p.