CVE-2026-67617 in Microweber
Summary
by MITRE • 08/04/2026
Microweber CMS through 2.0.20 contains a stored cross-site scripting vulnerability in the content tagging system that allows admin-authenticated attackers to inject arbitrary JavaScript by submitting malicious payloads via the tag_names parameter of the GET /api/save_content_admin endpoint, bypassing three independent sanitization controls including XSS middleware that ignores GET requests, a strip_unsafe() function that only matches double-quoted onerror attributes, and a titlecase normalizer that passes HTML decimal entity-encoded payloads through unchanged. Attackers can store malicious scripts that execute without user interaction for every visitor to the public blog page and within the admin post editor, enabling session riding through same-origin fetch requests using the CSRF token embedded in the page.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/04/2026
The vulnerability under discussion represents a critical stored cross-site scripting flaw within Microweber CMS version 2.0.20 and earlier, specifically targeting the content tagging system. This weakness allows authenticated administrators to inject malicious JavaScript code through the tag_names parameter of the GET /api/save_content_admin endpoint, creating a persistent security risk that affects all users interacting with the platform. The flaw stems from inadequate input validation and sanitization mechanisms that fail to properly filter malicious payloads before storing them in the database, making it particularly dangerous as the stored scripts execute automatically for every visitor to affected pages.
The technical implementation of this vulnerability demonstrates multiple layers of failed security controls that collectively enable the attack vector. The XSS middleware specifically ignores GET requests, creating a bypass mechanism that allows malicious payloads to pass through without proper validation. Additionally, the strip_unsafe() function implements overly restrictive filtering logic that only matches double-quoted onerror attributes, leaving other payload formats unaddressed. The titlecase normalizer further compounds the issue by passing HTML decimal entity-encoded payloads through unchanged, effectively neutralizing any encoding-based protection mechanisms. This multi-layered failure in sanitization controls creates multiple attack paths that an attacker can exploit to circumvent security measures.
The operational impact of this vulnerability extends far beyond simple script execution, creating a comprehensive attack surface that enables session riding and persistent malicious activity. When malicious scripts are stored in the database, they execute automatically for every visitor to public blog pages without requiring any user interaction, making this a particularly dangerous stored XSS vulnerability. Within the admin post editor, these scripts can also execute, potentially compromising administrator sessions and enabling further privilege escalation attacks. The ability to perform same-origin fetch requests using embedded CSRF tokens creates additional attack vectors that allow attackers to manipulate administrative functions and maintain persistent access to the compromised system.
Security mitigation strategies should focus on implementing robust input validation and sanitization mechanisms that address all identified bypass points within the application's security controls. The first priority involves strengthening the XSS middleware to properly validate all request methods including GET requests, while also enhancing the strip_unsafe() function to detect and neutralize a broader range of malicious patterns beyond simple double-quoted onerror attributes. The titlecase normalizer should be modified to properly decode and re-encode payloads before storage, preventing entity encoding bypasses that currently allow malicious content to persist. Additional measures should include implementing Content Security Policy headers, enforcing strict input validation at multiple layers, and conducting regular security audits to identify similar vulnerabilities in other application components.
This vulnerability aligns with CWE-79 (Cross-site Scripting) and demonstrates characteristics consistent with ATT&CK technique T1531 (Account Access Removal) through session riding capabilities, while also supporting T1213 (Data from Information Repositories) by enabling persistent access to administrative functions. The multi-layered bypass mechanisms indicate a fundamental flaw in the application's defense-in-depth strategy, where individual security controls fail to provide adequate protection against sophisticated attack vectors that exploit gaps between different sanitization layers. The vulnerability represents a significant risk to organizations relying on Microweber CMS for content management and requires immediate remediation to prevent potential exploitation by malicious actors seeking to compromise their web applications.