CVE-2026-116212— Webasyst Framework through 4.4.0 Stored XSS via Photos Album URL

Quick assessment

Affected

Webasyst Webasyst Framework

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Webasyst Framework 4.4.0 及以下版本在“照片”应用中存在存储型跨站脚本（XSS）漏洞。该漏洞允许已认证的后端用户通过相册的参数注入 JavaScript 代码。拥有相册编辑权限的攻击者可以保存一个恶意值，从而突破中未转义的属性限制，在管理员的后端会话中执行 JavaScript 代码。

CVSS 5.4 · Medium Updated Oct 26, 2026

Possible ATT&CK Techniques 3 AI

T1562 T1078 · Valid Accounts T1059 · Command and Scripting Interpreter

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Webasyst Framework through 4.4.0 Stored XSS via Photos Album URL

Source: CVE Program / CVE List V5

Vulnerability Description

Webasyst Framework through 4.4.0 contains a stored cross-site scripting vulnerability in the Photos app that allows authenticated backend users to inject JavaScript via the album url parameter. Attackers with album edit rights can save a url value that breaks out of the unescaped attribute in DialogAlbumSettings.html, executing JavaScript in administrators' backend sessions.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Webasyst	Webasyst Framework	0 ~ 4.4.0	-

II. Public POCs for CVE-2026-116212

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-116212

请登录查看更多情报信息。

Other References for CVE-2026-116212 (5)

https://github.com/webasyst/webasyst-framework/blob/cc609e5db23e68d982e15ebf65bf9d25120333af/wa-apps/photos/templates/actions/dialog/DialogAlbumSettings.html#L36 technical-description
https://github.com/webasyst/webasyst-framework/blob/cc609e5db23e68d982e15ebf65bf9d25120333af/wa-apps/photos/lib/actions/album/photosAlbumSave.controller.php#L107 technical-description
https://github.com/webasyst/webasyst-framework product
https://github.com/webasyst/webasyst-framework/issues/395 issue-tracking
https://www.vulncheck.com/advisories/webasyst-framework-through-4.4.0-stored-xss-via-photos-album-url third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-116212

Same Patch Batch · Webasyst · 2026-10-26 · 3 CVEs total

CVE-2026-116210	6.5 MEDIUM	Webasyst Framework through 4.4.0 Photos App CSRF via Backend Actions
CVE-2026-116213	4.9 MEDIUM	Webasyst Framework through 4.4.0 Arbitrary File Read via waArchiveTar Symlinks

IV. Related Vulnerabilities

Same product: Webasyst Framework

Same vendor: Webasyst

Same weakness: CWE-79