GHSL-2026-072: HTML encoding bypass enables cross-site scripting in Orchard CMS
Orchard CMS fails to HTML-encode StringValues output, allowing attackers to inject scripts into pages that render affected values.
Affected Software
Event History
Frequently Asked Questions
What must an attacker control to exploit this issue?
An attacker must be able to supply a StringValues value that is later rendered into an HTML page by Orchard CMS. If the value contains script-capable markup and reaches an affected output path, it may execute in a visitor's browser.
How can I determine whether my deployment is affected?
Review pages and templates that render StringValues output, especially where values originate from user-controlled request, form, query, or stored content. Test whether HTML-sensitive characters in those values are emitted unencoded in the rendered page.
What can be done before a fix is available?
Avoid rendering untrusted StringValues directly into HTML. Explicitly HTML-encode affected values before output, and restrict or validate user-controlled input that can reach those rendering paths.