Read the docs
TI-2026-30131 Aliases CVE-2026-41576

Ajax30/BraveCMS-2.0: Stored HTML Injection in Contact Email via nl2br() and Unescaped Blade Template

Priority LOW 31CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Brave CMS is an open-source CMS. Prior to commit 6c56603, the contact form is publicly accessible (no authentication required). User-supplied message text is passed through PHP's nl2br() function, which converts newlines to <br> tags but does not escape HTML. The resulting string is then passed to a Blade email template using the unescaped {!! $msg !!} directive. The resulting content is then rendered in a Blade email template using the unescaped {!! $msg !!} directive. Because HTML is not sanitized, arbitrary markup can be injected into the email body. While modern HTML-capable email clients (Gmail or Outlook Web) typically block JavaScript execution, they still render HTML content. This allows attackers to craft convincing phishing interfaces inside the email sent to the administrator. This issue has been patched via commit 6c56603.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00271 19th percentileScored 2026-11-07
Fix Fixed BraveCMS-2.0 (Ajax30): 6c5660373cf5f0ca9181603280427aca46ef11ea

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Ajax30BraveCMS-2.0before 6c5660373cf5f0ca9181603280427aca46ef11ea6c5660373cf5f0ca9181603280427aca46ef11eaPatch availableCNA
  • BraveCMS-2.0 VendorAjax30 Affected before 6c5660373cf5f0ca9181603280427aca46ef11ea Fixed in 6c5660373cf5f0ca9181603280427aca46ef11ea Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:ajax30:bravecms:*:*:*:*:*:*:*:*——Ajax30
  • cpe:2.3:a:ajax30:bravecms:*:*:*:*:*:*:*:* Versions — — ·Ajax30

Remediation

  • Fix · CNA BraveCMS-2.0 (Ajax30) Fixed in 6c5660373cf5f0ca9181603280427aca46ef11ea

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-41576

References

Other 2

  • TI-2026-27336 Missing authorization privilege escalation in Ajax30 BraveCMS-2.0 CVSS 3.1HIGH 8.8
  • TI-2026-27318 Brave CMS Sffected by Unrestricted File Upload via CKEditor Endpoint CVSS 3.1HIGH 8.8
  • TI-2026-30107 Ajax30/BraveCMS-2.0: Stored XSS in Page / Article Content CVSS 3.1HIGH 8.7
  • TI-2026-27337 Brave CMS has an Insecure Direct Object Reference in Article Image Deletion CVSS 3.1HIGH 7.1
  • TI-2026-27250 Brave CMS has Unrestricted File Upload in BraveCMS via CKEditor Endpoint CVSS 4.0CRITICAL 9.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences