CVE-2026-75526: fallo de gravedad media en django-cms
django CMS: Stored XSS in edit-mode plugin exception rendering
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 4.4epss 0.3%
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. From 5.0.8 until 5.0.9, ContentRenderer.render_placeholder in cms/plugin_rendering.py can pass stored, attacker-controlled values to ContentRenderer.render_exception when plugin rendering fails in edit mode. Values from get_short_description(), the exception message, the placeholder, or placeholder.source are interpolated into a cms-rendering-exception heading and later returned through mark_safe. Because the heading is not escaped, stored HTML executes in an editor’s browser, and settings.DEBUG does not prevent the custom heading from rendering. The fix uses format_html to escape the message before safe placeholder output is returned. This issue is fixed in versions 5.0.9.
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
Productos afectados
django-cms · django-cmsCVEs relacionadas — django-cms
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-54623HIGHdjango CMS: Plugin move endpoint allows cyclic reparenting (DoS)EPSS 0.5%CVE-2026-63003MEDIUMdjango CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass)EPSS 0.4%CVE-2026-54622MEDIUMdjango CMS: Clipboard copy IDOR discloses unauthorized plugin contentEPSS 0.4%CVE-2026-54624MEDIUMdjango CMS: Structure endpoint bypasses page-view permissionEPSS 0.4%CVE-2026-61663MEDIUMdjango CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staffEPSS 0.3%CVE-2026-54625MEDIUMdjango CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)EPSS 0.2%