CVE-2026-59078: Stored XSS in Edito CMS
Edito CMS is vulnerable to Stored XSS in avatar upload functionality. Authenticated attacker can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting an URL leading to a edited avatar.
This issue was fixed in version 5.10.2607. Hotfixes for older versions (5.8) have also been released.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.10.2607
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs to be authenticated to the Edito CMS instance and able to use the avatar upload functionality. Exploitation also requires a user to visit a URL that leads to the edited avatar.
What versions contain a fix?
The issue was fixed in Edito CMS version 5.10.2607. Hotfixes are also available for older 5.8 versions.
What is the impact when exploitation succeeds?
The attacker can inject arbitrary HTML and JavaScript that is rendered and executed when the affected avatar URL is visited. The described impact is limited to execution in the context of the affected website visitor.