Read the docs
TI-2026-30107 Aliases CVE-2026-41524

Ajax30/BraveCMS-2.0: Stored XSS in Page / Article Content

Priority HIGH 71CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Brave CMS is an open-source CMS. Prior to commit 6c56603, page and article body content entered through the CKEditor rich-text editor is stored verbatim in the database and subsequently rendered with Laravel Blade's unescaped output directive {!! !!}. Any JavaScript or HTML injected by an editor-role user is permanently stored and executed in every visitor's browser upon page load. This issue has been patched via commit 6c56603.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00261 18th percentileScored 2026-11-07
Fix Fixed BraveCMS-2.0 (Ajax30): 6c5660373cf5f0ca9181603280427aca46ef11ea

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Ajax30BraveCMS-2.0before 6c5660373cf5f0ca9181603280427aca46ef11ea6c5660373cf5f0ca9181603280427aca46ef11eaPatch availableCNA
  • BraveCMS-2.0 VendorAjax30 Affected before 6c5660373cf5f0ca9181603280427aca46ef11ea Fixed in 6c5660373cf5f0ca9181603280427aca46ef11ea Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:ajax30:bravecms:*:*:*:*:*:*:*:*——Ajax30
  • cpe:2.3:a:ajax30:bravecms:*:*:*:*:*:*:*:* Versions — — ·Ajax30

Remediation

  • Fix · CNA BraveCMS-2.0 (Ajax30) Fixed in 6c5660373cf5f0ca9181603280427aca46ef11ea

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-41524

References

Other 2

  • TI-2026-27336 Missing authorization privilege escalation in Ajax30 BraveCMS-2.0 CVSS 3.1HIGH 8.8
  • TI-2026-27318 Brave CMS Sffected by Unrestricted File Upload via CKEditor Endpoint CVSS 3.1HIGH 8.8
  • TI-2026-27337 Brave CMS has an Insecure Direct Object Reference in Article Image Deletion CVSS 3.1HIGH 7.1
  • TI-2026-27250 Brave CMS has Unrestricted File Upload in BraveCMS via CKEditor Endpoint CVSS 4.0CRITICAL 9.3
  • TI-2026-30131 Ajax30/BraveCMS-2.0: Stored HTML Injection in Contact Email via nl2br() and Unescaped Blade Template CVSS 3.1HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences