CVE-2026-116212: Webasyst Framework through 4.4.0 Stored XSS via Photos Album URL

Q: What privileges does an attacker need to exploit this issue?

The attacker must be an authenticated backend user with permission to edit Photos albums. They can save a crafted album URL value that injects JavaScript into the album settings dialog.

Q: Who is affected when a malicious album URL is saved?

Administrators whose backend sessions render the affected album settings dialog can have JavaScript executed in their sessions. The issue affects the Photos app’s album URL handling in Webasyst Framework through 4.4.0.

Published Oct 26, 2026

Updated

Webasyst Framework through 4.4.0 contains a stored cross-site scripting vulnerability in the Photos app that allows authenticated backend users to inject JavaScript via the album url parameter. Attackers with album edit rights can save a url value that breaks out of the unescaped attribute in DialogAlbumSettings.html, executing JavaScript in administrators' backend sessions.

Affected Software

1 affected component

Webasyst Webasyst Framework<=4.4.0

Event History

Oct 26, 2026

CVE Published

via MITRE·01:08 PM

Data Sourced

via MITRE·01:08 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What privileges does an attacker need to exploit this issue?

The attacker must be an authenticated backend user with permission to edit Photos albums. They can save a crafted album URL value that injects JavaScript into the album settings dialog.

Who is affected when a malicious album URL is saved?

Administrators whose backend sessions render the affected album settings dialog can have JavaScript executed in their sessions. The issue affects the Photos app’s album URL handling in Webasyst Framework through 4.4.0.

CVE-2026-116212: Webasyst Framework through 4.4.0 Stored XSS via Photos Album URL

Affected Software

Event History

Frequently Asked Questions

What privileges does an attacker need to exploit this issue?

Who is affected when a malicious album URL is saved?

Company

Resources

Contact

Frequently Asked Questions

What privileges does an attacker need to exploit this issue?

Who is affected when a malicious album URL is saved?