{"id":"CVE-2026-18478","aliases":["EUVD-2026-55624","GHSA-jp3f-93v6-xm3f"],"status":"published","title":"Stored XSS in Magnolia CMS","description":"Magnolia CMS is vulnerable to Stored XSS in import functionality. An attacker with editor privileges can inject arbitrary HTML and JS into the name of uploaded image, which will be rendered/executed when opening uploaded image.\n\n\n\n\nThe issue was fixed in version 6.3.10","severity":{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0046,"percentile":0.40146,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2026-08-10T13:00:16Z","modified":"2026-10-23T20:10:00Z","products":[{"vendor":"magnolia dxp","product":"magnolia cms"}],"references":[{"url":"https://cert.pl/en/posts/2026/08/CVE-2026-18478","tags":["third-party-advisory"]},{"url":"https://docs.magnolia-cms.com/product-docs/6.3/releases/release-notes-for-magnolia-cms-6.3.10/","tags":["release-notes"]},{"url":"https://www.magnolia-cms.com/","tags":["product"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18478"},{"url":"https://docs.magnolia-cms.com/product-docs/6.3/releases/release-notes-for-magnolia-cms-6.3.10"},{"url":"https://www.magnolia-cms.com"},{"url":"https://github.com/advisories/GHSA-jp3f-93v6-xm3f"}],"sources":{"cve":[{"id":"CVE-2026-18478","title":"Stored XSS in Magnolia CMS","description":"Magnolia CMS is vulnerable to Stored XSS in import functionality. An attacker with editor privileges can inject arbitrary HTML and JS into the name of uploaded image, which will be rendered/executed when opening uploaded image.\n\n\n\n\nThe issue was fixed in version 6.3.10","status":"published","published":"2026-08-10T13:00:16.854Z","modified":"2026-08-10T17:58:41.118Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:20:12.60856Z"}],"euvd":[{"id":"EUVD-2026-55624","description":"Magnolia CMS is vulnerable to Stored XSS in import functionality. An attacker with editor privileges can inject arbitrary HTML and JS into the name of uploaded image, which will be rendered/executed when opening uploaded image.\n\n\n\n\nThe issue was fixed in version 6.3.10","status":"published","published":"2026-08-10T13:00:16Z","modified":"2026-08-10T17:58:41Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"updated_at":"2026-11-02T18:02:01.104981Z"}],"ghsa":[{"id":"GHSA-jp3f-93v6-xm3f","title":"Magnolia CMS is vulnerable to Stored XSS in import functionality. An attacker with editor...","description":"Magnolia CMS is vulnerable to Stored XSS in import functionality. An attacker with editor privileges can inject arbitrary HTML and JS into the name of uploaded image, which will be rendered/executed when opening uploaded image.\n\n\n\n\nThe issue was fixed in version 6.3.10","status":"published","published":"2026-08-10T15:33:51Z","modified":"2026-08-10T15:33:59Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:10:14.126548Z"}],"nvd":[{"id":"CVE-2026-18478","description":"Magnolia CMS is vulnerable to Stored XSS in import functionality. An attacker with editor privileges can inject arbitrary HTML and JS into the name of uploaded image, which will be rendered/executed when opening uploaded image.\n\n\n\n\nThe issue was fixed in version 6.3.10","status":"published","published":"2026-08-10T14:17:21.403Z","modified":"2026-10-23T20:10:00.16Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:36.102748Z"}]}}