Stored XSS Vulnerability in Magnolia CMS Affecting Recent Versions

CVE-2026-18478

What is CVE-2026-18478?

Magnolia CMS contains a vulnerability in its import functionality, where an attacker with editor privileges can exploit the system. By injecting malicious HTML and JavaScript code into the name of an uploaded image, the injected content may be rendered and executed upon accessing the image. This presents a significant security risk as it can lead to unauthorized actions, data interception, and potentially allow the attacker to further compromise the application or its users. The issue was rectified in Magnolia CMS version 6.3.10, underscoring the importance of keeping software up to date to mitigate risks associated with known vulnerabilities.

References