TI-2025-43317 Aliases CVE-2025-71177 GHSA-w7rq-fgx4-4xcm

LavaLite CMS <= 10.1.0 Stored XSS via Package Creation and Search

MEDIUM 56CWE-79Published 2026-01-23 · Updated 2026-10-08

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

LavaLite CMS versions up to and including 10.1.0 contain a stored cross-site scripting vulnerability in the package creation and search functionality. Authenticated users can supply crafted HTML or JavaScript in the package Name or Description fields that is stored and later rendered without proper output encoding in package search results. When other users view search results that include the malicious package, the injected script executes in their browsers, potentially enabling session hijacking, credential theft, and unauthorized actions in the context of the victim.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00223 12th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
lavalite	LavaLite CMS	up to 10.1.0	—	No fix listed	CNA
—	lavalite/cms (Packagist)	up to 10.1.0	—	No fix listed	GHSA-w7rq-fgx4-4xcm

LavaLite CMS Vendorlavalite Affected up to 10.1.0 Fixed in — No fix listed CNA
lavalite/cms (Packagist) Vendor— Affected up to 10.1.0 Fixed in — No fix listed GHSA-w7rq-fgx4-4xcm

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:lavalite:lavalite::::::::	up to 10.1.0	Vulnerable	lavalite

cpe:2.3:a:lavalite:lavalite:*:*:*:*:*:*:*:* Versions up to 10.1.0 Vulnerable ·lavalite

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2025-71177
2026-10-03 Alias added: GHSA-w7rq-fgx4-4xcm

References

Exploit 1

https://github.com/LavaLite/cms/issues/420

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2025-71177

Other 3

TI-2025-43153 LavaLite CMS 10.1.0 is vulnerable to Incorrect Access Control. CVSS 3.1HIGH 8.8
TI-2022-20443 In Lavalite 9.0.0, the XSRF-TOKEN cookie is vulnerable to path traversal attacks… CVSS 3.1HIGH 7.5
TI-2023-11992 LavaLite CMS v 9.0.0 was discovered to be vulnerable to web cache poisoning. CVSS 3.1CRITICAL 9.8
TI-2023-18730 LavaLite CMS v 9.0.0 is vulnerable to Sensitive Data Exposure. CVSS 3.1HIGH 7.5
TI-2023-18729 LavaLite CMS v 9.0.0 is vulnerable to Sensitive Data Exposure. CVSS 3.1HIGH 7.5
TI-2019-13610 XSS exists in Lavalite CMS 5.7 via the admin/profile name or designation field. CVSS 3.1MEDIUM 6.1

See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences