Stored Cross-Site Scripting in CamaleonCMS by Camaleon

CVE-2026-73329

What is CVE-2026-73329?

CamaleonCMS is vulnerable to a stored cross-site scripting attack that allows authenticated low-privileged users to introduce arbitrary JavaScript into the browser of administrators. This vulnerability occurs when unsanitized HTML payloads are injected into the post title during draft creation. Attackers can utilize the drafts creation endpoint to submit malicious HTML, which is then stored in the database without proper escaping. As a result, the injected code can be rendered as raw HTML in the admin drafts listing, potentially enabling session hijacking, cookie theft, and unauthorized requests from the administrator.

References