CVE-2026-18478— Stored XSS in Magnolia CMS
Possible ATT&CK Techniques 3AI
T1055 · Process Injection T1059 · Command and Scripting Interpreter T1189 · Drive-by CompromiseAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Magnolia DXP | Magnolia CMS | 6.3.0< 6.3.10 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-18478
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Stored XSS in Magnolia CMS
Source: CVE Program / CVE List V5
Vulnerability Description
Magnolia CMS is vulnerable to Stored XSS in import functionality. An attacker with editor privileges can inject arbitrary HTML and JS into the name of uploaded image, which will be rendered/executed when opening uploaded image. The issue was fixed in version 6.3.10
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
Magnolia DXP Magnolia CMS 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Magnolia DXP Magnolia CMS是Magnolia DXP的一款企业级内容管理系统。 Magnolia DXP Magnolia CMS 6.3.0版本至6.3.10之前版本存在跨站脚本漏洞，该漏洞源于导入功能存在存储型跨站脚本漏洞，具有编辑器权限的攻击者可在上传图片名称中注入任意HTML和JS，打开图片时执行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Magnolia DXP | Magnolia CMS | 6.3.0 ~ 6.3.10 | - |
II. Public POCs for CVE-2026-18478
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-18478
请登录查看更多情报信息。
Security Blog Posts for CVE-2026-18478 (1)
- 🔗 Vulnerability in Magnolia CMS software | CERT Polskathird-party-advisory
Vendor Pages for CVE-2026-18478 (1)
IV. Related Vulnerabilities
Same weakness: CWE-79
- CVE-2026-70560
Ultimate POS Stored XSS via First Name Field in Leave Notifi - CVE-2026-9318
tablib versions prior to 3.10.0 Stored XSS via HTML Export D - CVE-2026-66146
GMS 9.5.1前版本存在跨站脚本（XSS）漏洞 - CVE-2026-73031
telegram-search Stored XSS via v-html in MessageList.vue - CVE-2026-48414
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
V. Comments for CVE-2026-18478
No comments yet