Stored Cross-Site Scripting Vulnerability in Omnispace Agora Project

CVE-2026-63171

What is CVE-2026-63171?

The Omnispace Agora Project, prior to version 26.10.0, is susceptible to a stored cross-site scripting vulnerability. This flaw allows authenticated attackers to exploit a weakness in the input handling of forum category descriptions. By injecting a specially crafted description that includes a double-quote character, attackers can manipulate the HTMLPurifier configuration, leading to script execution within the browsers of users who view these manipulated forum categories. This vulnerability emphasizes the importance of robust input validation and sanitization to prevent potential exploits.

References