CVE-2026-79363 in Cloudron
Summary
by MITRE • 10/09/2026
Cloudron 9.1.7 and 9.2 contain a stored cross-site scripting (XSS) vulnerability in the Branding Footer feature. An authenticated administrator can store crafted HTML containing JavaScript event handlers in the Footer setting. The stored value is rendered without sufficient sanitization on the public login / OpenID interaction page and in the System Event Log, causing attacker-controlled JavaScript to execute in the Cloudron web origin when an affected page is viewed.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/09/2026
Cloudron versions 9.1.7 through 9.2 contain a stored cross-site scripting vulnerability within the Branding Footer feature that allows authenticated administrators to inject malicious scripts into public-facing interfaces. This flaw stems from insufficient input sanitization and output encoding when rendering user-supplied data in specific system components. The vulnerability specifically affects the footer section of the application's branding configuration, where an administrator can define custom HTML content including JavaScript event handlers. Because this stored payload is subsequently rendered without adequate validation on sensitive pages such as the public login interface and the System Event Log, it creates a persistent execution environment for attacker-controlled code within the context of the Cloudron web origin.
The technical nature of this vulnerability aligns with CWE-79, which classifies improper neutralization of input during web page generation known as cross-site scripting. In this scenario, the application fails to properly sanitize or encode special characters that could be interpreted as executable script code when displaying the footer content. The persistence aspect distinguishes it from reflected XSS variants; once an administrator saves a crafted payload containing JavaScript event handlers, the malicious code is stored in the backend configuration and served to every user who accesses the affected pages. This includes unauthenticated users visiting the login screen or any other page that incorporates the branded footer, thereby expanding the potential attack surface beyond just administrative actions.
From an operational impact perspective, this vulnerability enables a wide range of malicious activities depending on the privileges of the administrator account used to store the payload and the context in which it executes. Since the script runs within the Cloudron web origin, attackers can perform session hijacking by stealing authentication cookies or tokens associated with active user sessions. They may also conduct phishing attacks by modifying the login page interface to capture credentials from legitimate users. Furthermore, because the System Event Log is affected, an attacker could manipulate log entries to obscure malicious activities or create false alerts that disrupt system monitoring and incident response efforts. The ability to execute arbitrary JavaScript in this context effectively compromises the integrity of the user experience and potentially leads to full account compromise if combined with other vulnerabilities or social engineering tactics.
This vulnerability maps directly to MITRE ATT&CK technique T1059, specifically sub-technique 007 which covers command and script interpretation via web browsers. The stored nature of the payload corresponds to persistence mechanisms where malicious code remains active across multiple user sessions until manually removed from the configuration. Defense in depth strategies are critical for mitigating this risk. Administrators should ensure that Cloudron is updated to a version newer than 9.2, as these versions contain patches addressing the input validation flaws. Additionally, implementing strict Content Security Policy headers can help mitigate the impact by restricting the sources from which scripts are allowed to execute. Input sanitization libraries that enforce allow-listing of permitted HTML tags and attributes should be utilized in future development cycles to prevent similar injection vectors. Regular security audits focusing on output encoding practices across all user-facing components will further reduce the likelihood of such vulnerabilities being introduced into the application stack.