CVE-2026-93456 in django-page-cms
Summary
by MITRE • 09/18/2026
django-page-cms through 2.0.13 exempts five admin mutation views from CSRF protection in pages/admin/views.py, allowing attackers to forge requests that modify page content. Signed-in editors visiting a malicious page can be tricked into storing unescaped content that renders to all visitors, enabling stored cross-site scripting attacks.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified in django-page-cms versions through 2.0.13 represents a critical failure in access control and input validation mechanisms within the administrative interface of the web application framework. Specifically, five distinct mutation views located in the pages/admin/views.py module were improperly configured to bypass Cross-Site Request Forgery (CSRF) protection checks. In standard Django applications, CSRF tokens are essential for verifying that state-changing requests originate from legitimate users interacting with their own sessions rather than malicious third-party sites attempting to perform actions on behalf of authenticated users without their consent. By exempting these specific administrative endpoints from this security control, the application creates a significant attack vector where an attacker can craft forged HTTP POST or PUT requests that are accepted and executed by the server as if they were initiated by an authorized administrator or editor.
This architectural flaw directly facilitates stored cross-site scripting attacks when combined with insufficient output encoding in the rendering pipeline. An attacker who has obtained valid credentials for a signed-in editor account, or potentially exploits social engineering to trick such a user into visiting a malicious page containing crafted requests, can submit content that includes unescaped JavaScript code. Because the CSRF protection is absent at the point of ingestion, the server processes this request and stores the malicious payload in the database without raising an error or rejecting it due to missing authentication tokens. The severity of this issue is compounded by the fact that django-page-cms serves as a platform for managing public-facing web content, meaning that any stored script will be rendered dynamically when other users visit the affected pages.
The operational impact of this vulnerability extends beyond simple session hijacking or unauthorized data modification to include persistent client-side code execution across all visitors viewing the compromised page. Once the unescaped malicious content is stored in the backend database, it becomes part of the dynamic HTML response served to every user who accesses that specific URL. This allows attackers to execute arbitrary JavaScript in the context of the victim's browser session, which can lead to theft of sensitive cookies and authentication tokens, redirection to phishing sites, keylogging, or defacement of the website content. The persistence of this attack vector means that remediation requires not only patching the code but also actively cleaning any injected scripts from existing database records if an exploitation has already occurred.
From a classification perspective, this vulnerability aligns with CWE-352 Cross-Site Request Forgery due to the lack of anti-CSRF tokens on state-changing operations and CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as cross-site scripting. The attack methodology corresponds to MITRE ATT&CK technique T1059 Command and Scripting Interpreter, specifically through browser-based execution via stored payloads, and potentially T1132 Data Encoding for obfuscation if the attacker encodes scripts to bypass basic filters before storage. To mitigate this issue, organizations must upgrade immediately to a version of django-page-cms that includes patches for these administrative views or apply manual code fixes to re-enable CSRF token verification on all mutation endpoints within pages/admin/views.py. Additionally, developers should implement strict output encoding and content security policies to ensure that even if malicious input is stored, it cannot be executed as active script by client browsers.