CVE-2026-41147 NukeViet CMS: Stored Cross-Site Scripting (XSS) via insufficient server-side input sanitization in Request class
Attackers can inject malicious scripts via unfiltered input, leading to session hijacking and unauthorized actions for users viewing the content.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-41147?
CVE-2026-41147 is a high-severity cross-site scripting vulnerability in nukeviet, published on 22 May 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
NukeViet CMS is a multi Content Management System. Versions 4.5.07 and prior contain a Stored Cross-Site Scripting (XSS) vulnerability caused by insufficient server-side input sanitization in the Request class. The application relies primarily on client-side filtering to sanitize HTML tags and attributes in user-submitted content, which can be bypassed by intercepting and modifying HTTP requests directly (e.g., using Burp Suite). An attacker can inject malicious payloads which are stored server-side and executed in the browser of any user who views the content. Anyone viewing user-submitted content (such as administrators and moderators reviewing contact messages or comments) is impacted, and the vulnerability can be exploited by any anonymous visitor without authentication, with the Contact module used only as a proof of concept. Potential consequences include session hijacking through cookie theft, unauthorized actions performed under the victim's identity, defacement or redirection to phishing pages, and phishing attacks via manipulated email notifications. This issue has been fixed in version 4.5.08. If developers are unable to upgrade immediately, they should work around this issue by implementing server-side HTML sanitization in the Request class to strip or encode dangerous tags and attributes (e.g., <iframe>, srcdoc, event handlers like onerror/onload), enforcing a Content Security Policy (CSP) to restrict inline script execution, and set cookies with the HttpOnly flag to mitigate cookie theft via XSS.
Weakness: CWE-79
Which versions are affected by CVE-2026-41147?
2 open source packages ship an affected version, including nukeviet/nukeviet.
| Package | Affected | Fixed in |
|---|---|---|
nukeviet/nukeviet Packagist | All versions to 4.4.01 | None |
nukeviet/nukeviet Packagist | All versions to 4.4.01 | None |
How do I fix CVE-2026-41147?
No fix has been published for CVE-2026-41147 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-41147 being exploited?
There is no known exploitation of CVE-2026-41147 in the wild and no public exploit code.
Sources
Also known as GHSA-64rr-pp78-62ww.