CVE-2026-85382: light0011 cms Chapter Content Output oneChapter.tpl htmlspecialchars_decode cross site scripting
A vulnerability was detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Impacted is the function htmlspecialcharsdecode of the file App/Home/View/Default/Chapter/oneChapter.tpl of the component Chapter Content Output. Performing a manipulation of the argument content results in cross site scripting. Remote exploitation of the attack is possible. The exploit is now public and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker needs to be able to manipulate the content argument rendered by the Chapter Content Output component. Exploitation is remote and requires user interaction, consistent with the UI:R metric.
Is there a known public exploit?
Yes. The available data states that an exploit is public and may be used, which increases the likelihood of exploitation attempts.
Which releases should be treated as potentially affected?
The affected code is identified by the revisions c774dce31c6df0055568a8d5c53d964d99be199d and f72cf46f601efb2a0618c3814cc2f61380b38930. Because the project uses a rolling-release model, no affected or fixed release versions are provided.
Is a vendor fix available?
No response from the project is reported after it was informed through an issue report. The supplied information does not identify an official fix or updated release.