« Volver al listado

CVE-2026-41524

Estado: AplazadaAlta (8.7)—

Brave CMS is an open-source CMS. Prior to commit 6c56603, page and article body content entered through the CKEditor rich-text editor is stored verbatim in the database and subsequently rendered with Laravel Blade's unescaped output directive {!! !!}. Any JavaScript or HTML injected by an editor-role user is permanently stored and executed in every visitor's browser upon page load. This issue has been patched via commit 6c56603.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

XSS persistente: usuario con rol editor inyecta JavaScript en CKEditor, almacenado sin sanitizar y ejecutado en navegadores de visitantes mediante {!! !!} de Blade. Requisito UI:R y PR:L confirma T1189 (drive-by). Impacto T1059.007 (ejecución JS) e impersonación de sesiones (T1078).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

User TrainingRestrict Web-Based ContentApplication Developer GuidanceActive Directory ConfigurationUser Account ManagementPrivileged Account Management

Tecnologías afectadas (3)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Brave CMS — Brave CMSAICkeditor — CkeditorAILaravel — BladeAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-41524",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-41524",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-05-08T17:07:52.090888Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.7,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.8,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "Ajax30",
          "product": "BraveCMS-2.0",
          "versions": [
            {
              "status": "affected",
              "version": "< 6c5660373cf5f0ca9181603280427aca46ef11ea"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-05-08T15:16:40.253",
  "references": [
    {
      "url": "https://github.com/Ajax30/BraveCMS-2.0/commit/6c5660373cf5f0ca9181603280427aca46ef11ea",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Ajax30/BraveCMS-2.0/security/advisories/GHSA-xj46-722x-6433",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Ajax30/BraveCMS-2.0/security/advisories/GHSA-xj46-722x-6433",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Brave CMS is an open-source CMS. Prior to commit 6c56603, page and article body content entered through the CKEditor rich-text editor is stored verbatim in the database and subsequently rendered with Laravel Blade's unescaped output directive {!! !!}. Any JavaScript or HTML injected by an editor-role user is permanently stored and executed in every visitor's browser upon page load. This issue has been patched via commit 6c56603."
    }
  ],
  "lastModified": "2026-06-17T10:46:50.120",
  "sourceIdentifier": "security-advisories@github.com"
}