CVE-2026-29840: XSS
JiZhiCMS v2.5.6 and before contains a Stored Cross-Site Scripting (XSS) vulnerability in the release function within app/home/c/UserController.php. The application attempts to sanitize input by filtering <script> tags but fails to recursively remove dangerous event handlers in other HTML tags (such as onerror in <img> tags). This allows an authenticated remote attacker to inject arbitrary web script or HTML via the body parameter in a POST request to /user/release.html.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-29840?
CVE-2026-29840 has a medium severity rating due to its impact on user data and security.
How do I fix CVE-2026-29840?
To fix CVE-2026-29840, upgrade JiZhiCMS to version 2.5.7 or later, which contains the necessary security patches.
What type of vulnerability is CVE-2026-29840?
CVE-2026-29840 is a Stored Cross-Site Scripting (XSS) vulnerability affecting JiZhiCMS.
Which versions of JiZhiCMS are affected by CVE-2026-29840?
Versions of JiZhiCMS up to and including 2.5.6 are affected by CVE-2026-29840.
What are the potential consequences of CVE-2026-29840?
The consequences of CVE-2026-29840 could include unauthorized access to user data and sessions due to XSS attacks.