Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-61696— Forem: Stored XSS in Admin Abuse Report Rendering

Quick assessment

Affected
forem forem
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Forem是Forem公司开源的一个构建在线社区/论坛的Ruby开源项目。 Forem 存在安全漏洞，该漏洞源于FeedbackMessagesController未授权接受报告，且通过feedback_message[message]参数提交的恶意值未经过清理即被存储，并在app/views/admin/feedback_messages/_feedback_message.html.erb中通过raw()渲染，可能导致管理员浏览器中执行任意JavaScript、暴露敏感页面数据、滥用CSRF令牌或在受

CVSS 6.3 · Medium EPSS 0.23% · P14

Affected Version Matrix 1

VendorProduct Version RangeStatus
forem forem < 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-61696

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Forem: Stored XSS in Admin Abuse Report Rendering
Source: CVE Program / CVE List V5
Vulnerability Description
Forem is open source software for building communities. In versions before commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c, a malicious value submitted through feedback_message[message] is stored without sanitization and rendered in app/views/admin/feedback_messages/_feedback_message.html.erb through raw(feedback_message.message) when offender_id is present. Viewing the abuse report executes arbitrary JavaScript in an administrator's browser and may expose sensitive in-page data, abuse CSRF tokens, or perform administrative actions in the victim's session. The public FeedbackMessagesController accepts the report without authorization and previously permitted a submitted offender_id, making the vulnerable rendering path reachable by an unauthenticated attacker. This issue is fixed in commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
输出中的特殊元素转义处理不恰当(注入)
Source: CVE Program / CVE List V5
Vulnerability Title
Forem 输出处理不当漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Forem是Forem公司开源的一个构建在线社区/论坛的Ruby开源项目。 Forem 存在安全漏洞，该漏洞源于FeedbackMessagesController未授权接受报告，且通过feedback_message[message]参数提交的恶意值未经过清理即被存储，并在app/views/admin/feedback_messages/_feedback_message.html.erb中通过raw()渲染，可能导致管理员浏览器中执行任意JavaScript、暴露敏感页面数据、滥用CSRF令牌或在受
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
forem forem < 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c -

II. Public POCs for CVE-2026-61696

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-61696

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-61696 (1)

Vendor Advisories for CVE-2026-61696 (1)

IV. Related Vulnerabilities

Same product: forem
Same vendor: forem
Same weakness: CWE-74

V. Comments for CVE-2026-61696

No comments yet

Leave a comment