Read the docs
TI-2025-35286 Aliases CVE-2025-56236GHSA-4fxf-xgrm-8fcj

FormCms v0.5.5 contains a stored cross-site scripting (XSS) vulnerability in the avatar…

Priority LOW 27CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting, Code execution
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-79 and CWE-434.

Summary

FormCms v0.5.5 contains a stored cross-site scripting (XSS) vulnerability in the avatar upload feature. Authenticated users can upload .html files containing malicious JavaScript, which are accessible via a public URL. When a privileged user accesses the file, the script executes in their browser context.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00203 10th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed FormCMS (NuGet): 0.5.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—FormCMS (NuGet)before 0.5.70.5.7Patch availableGHSA-4fxf-xgrm-8fcj
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • FormCMS (NuGet) Vendor— Affected before 0.5.7 Fixed in 0.5.7 Patch available GHSA-4fxf-xgrm-8fcj

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:formcms:formcms:*:*:*:*:*:*:*:*0.5.5 to before 0.5.7VulnerableFormcms
  • cpe:2.3:a:formcms:formcms:*:*:*:*:*:*:*:* Versions 0.5.5 to before 0.5.7 Vulnerable ·Formcms

Remediation

  • Fix · GHSA-4fxf-xgrm-8fcj FormCMS (NuGet) Fixed in 0.5.7 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-56236
  2. 2026-10-03 Alias added: GHSA-4fxf-xgrm-8fcj

References

Exploit 1

Advisory 2

Other 1

  • TI-2025-35182 An improper access control vulnerability in FormCms v0.5.4 in the… CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences