CVE-2026-92381: PbootCMS Template Rendering ContentController.php decode_string cross site scripting

Q: Which installations are in scope?

PbootCMS installations running versions up to 3.2.22 are affected where the Template Rendering component uses ContentController.php's decode_string function.

Q: What does exploitation require?

The attack can be performed remotely, but requires low-level privileges and user interaction. It involves manipulating the Title argument to trigger cross-site scripting.

Q: How likely is active exploitation?

Public exploit information is available, so the issue could be used in attacks.

Published Sep 16, 2026

Updated

A weakness has been identified in PbootCMS up to 3.2.22. This affects the function decodestring of the file apps/admin/controller/content/ContentController.php of the component Template Rendering. This manipulation of the argument Title causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The reported GitHub issue was closed with the reason "completed".

Affected Software

1 affected component

Pbootcms PbootCMS Template Rendering (ContentController.php decode_string)<=3.2.22

Event History

Sep 16, 2026

CVE Published

via MITRE·02:45 PM

Data Sourced

via MITRE·02:45 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which installations are in scope?

PbootCMS installations running versions up to 3.2.22 are affected where the Template Rendering component uses ContentController.php's decode_string function.

What does exploitation require?

The attack can be performed remotely, but requires low-level privileges and user interaction. It involves manipulating the Title argument to trigger cross-site scripting.

How likely is active exploitation?