SA-CORE-2026-016: XSS
The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containing specific data attributes, or the administer menu permission.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 11.4.10Fixed in 11.3.19Fixed in 10.6.19
Event History
Frequently Asked Questions
Who is able to exploit this vulnerability?
An attacker must have either a role permitted to enter HTML tags containing specific data attributes or the administer menu permission. Users without either of these permissions are not described as able to exploit it.
Is this exposure limited to administrators?
No. The vulnerability can also be exploited by a user who is allowed to enter HTML tags containing the relevant data attributes, even if that user does not have the administer menu permission.
What should be reviewed if patching cannot happen immediately?
Review which roles can enter HTML tags containing specific data attributes and which users have the administer menu permission. Restrict those permissions to trusted users until remediation is available.