CVE-2026-79363: XSS

Published Oct 9, 2026

Updated

Cloudron 9.1.7 and 9.2 contain a stored cross-site scripting (XSS) vulnerability in the Branding Footer feature. An authenticated administrator can store crafted HTML containing JavaScript event handlers in the Footer setting. The stored value is rendered without sufficient sanitization on the public login / OpenID interaction page and in the System Event Log, causing attacker-controlled JavaScript to execute in the Cloudron web origin when an affected page is viewed.

Affected Software

1 affected component

Cloudron Cloudron=9.1.7, =9.2

Event History

Oct 9, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

Who can exploit this vulnerability?

An authenticated Cloudron administrator can exploit it by saving crafted HTML with JavaScript event handlers in the Branding Footer setting. Exploitation requires a user to view the affected public login or OpenID interaction page, or the System Event Log.

Which interfaces render the malicious stored footer content?

The crafted Footer value is rendered on the public login / OpenID interaction page and in the System Event Log. JavaScript executes in the Cloudron web origin when one of these affected pages is viewed.

How can I determine whether an instance is affected?

The affected versions identified are Cloudron 9.1.7 and 9.2. Review the Branding Footer setting for HTML containing JavaScript event handlers and inspect affected pages for unexpected footer content.

CVE-2026-79363: XSS

Affected Software

Event History

Frequently Asked Questions

Who can exploit this vulnerability?

Which interfaces render the malicious stored footer content?

How can I determine whether an instance is affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this vulnerability?

Which interfaces render the malicious stored footer content?

How can I determine whether an instance is affected?