CVE-2026-96739 in SEMCMS
Summary
by MITRE • 09/24/2026
A flaw has been found in SEMCMS up to 4.2. Affected by this issue is some unknown functionality of the file /Edit/php/upload_json.php of the component KindEditor Upload Interface. This manipulation of the argument imgFile causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/24/2026
The vulnerability identified in SEMCMS versions up to 4.2 represents a significant security risk stemming from improper input validation within the application's file upload mechanism. Specifically, the flaw resides in the KindEditor Upload Interface component, which is accessed through the script located at /Edit/php/upload_json.php. This module serves as an intermediary for handling image uploads initiated by users interacting with the rich text editor interface. The core technical deficiency lies in how the system processes the imgFile argument passed during these upload operations. Instead of strictly validating or sanitizing the input data, the application fails to adequately filter malicious content embedded within file metadata or associated parameters before processing them further into the web page context.
This lack of rigorous validation allows an attacker to inject executable script payloads directly into the response generated by the server when handling uploaded files. When a victim user loads a webpage containing this manipulated content, their browser executes the injected scripts in the security context of the SEMCMS application domain. This constitutes a classic Stored Cross-Site Scripting vulnerability, categorized under CWE-79 in the Common Weakness Enumeration standard. The persistence aspect is particularly dangerous because the malicious code is stored on the server side and served to multiple users over time, rather than being limited to a single session or request as seen in reflected XSS attacks.
The operational impact of this vulnerability extends beyond simple script execution. An attacker leveraging this flaw can perform a variety of malicious actions against affected users. These include stealing sensitive cookies that maintain user authentication sessions, thereby allowing the attacker to hijack active administrative or user accounts without needing valid credentials. Additionally, the attacker could redirect victims to phishing sites designed to harvest additional personal information or deploy malware onto the victim's system through drive-by download techniques facilitated by the trusted domain context. Since the exploit has been published and is known to be functional, automated scanning tools and malicious actors can readily identify vulnerable instances of SEMCMS on the internet, increasing the likelihood of successful attacks against unpatched systems.
The remote nature of this attack vector means that no physical access or local network proximity is required for exploitation. An attacker only needs a victim with an active session to visit a compromised page where the malicious payload has been injected via the upload interface. The fact that the vendor did not respond to early disclosure attempts highlights a critical gap in security maintenance and support, leaving users without official patches or guidance on remediation from the original developers. This silence forces administrators to rely on community-driven solutions or manual code modifications to secure their deployments.
To mitigate this risk, immediate action is required for all organizations running SEMCMS versions prior to 4.2. The most effective mitigation involves applying any available updates if a patched version has been released through alternative channels such as forks or third-party maintainers who may have addressed the issue. If no official patch exists, administrators must manually modify the /Edit/php/upload_json.php file to implement strict input validation and output encoding for all user-supplied data, particularly focusing on the imgFile parameter. Implementing a Web Application Firewall with rules specifically targeting XSS patterns can also provide an additional layer of defense by blocking malicious requests before they reach the application logic. Furthermore, enabling HttpOnly flags on session cookies reduces the impact of any successful script execution by preventing client-side scripts from accessing sensitive cookie data. Regular security audits and code reviews are essential to prevent similar vulnerabilities in future development cycles, ensuring that input sanitization is a standard practice rather than an afterthought.