CVE-2026-82664: yaojingang GEOFlow JSON-LD Theme HomeController.php cross site scripting
A security vulnerability has been detected in yaojingang GEOFlow up to 2.1.0. This affects an unknown part of the file app/Http/Controllers/Site/HomeController.php of the component JSON-LD Theme Handler. The manipulation of the argument Search leads to cross site scripting. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.1.1 is able to mitigate this issue. The identifier of the patch is 67abfd864a15d169a78429f3290c91cb3b93e849. Upgrading the affected component is recommended.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
yaojingang GEOFlowto a version that resolves this vulnerability.Fixed in 2.1.1Patch 67abfd864a15d169a78429f3290c91cb3b93e849
Event History
Frequently Asked Questions
Which deployments are affected?
yaojingang GEOFlow versions up to and including 2.1.0 are affected in the JSON-LD Theme Handler, specifically an unknown portion of app/Http/Controllers/Site/HomeController.php.
What does an attacker need to exploit this issue?
The issue can be exploited remotely by manipulating the Search argument. No privileges are required, but user interaction is required for successful exploitation.
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used.
What is the recommended remediation?
Upgrade GEOFlow to version 2.1.1. The referenced patch identifier is 67abfd864a15d169a78429f3290c91cb3b93e849.