---
id: "CVE-2026-116100"
kind: "vulnerability"
aliases: ["CVE-2026-116100"]
title: "gougucms: User Level add function lets Title field run cross-site scripting"
severity: "low"
cvss: 3.3
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["gougucms", "other", "php", "self-hosted"]
not_affected_if: ["default-config"]
published_at: "2026-10-26T01:17:15+00:00"
first_seen_at: "2026-10-26T01:38:48+00:00"
updated_at: "2026-10-26T01:40:56+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116100", "first_seen_at": "2026-10-26T01:38:48+00:00"}]
---

# gougucms: User Level add function lets Title field run cross-site scripting

gougucms up to version 4.08.18 does not sanitize the Title argument in the Add function of app/admin/controller/Level.php, which handles user levels. An attacker can inject script that runs in the browser of a user who views the affected page.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed gougucms version against `4.08.18`, unknown whether later versions are patched
- Review `app/admin/controller/Level.php` for the Add function and whether the Title input is escaped on output

## Timeline

- 2026-10-26T01:38:48+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116100

## From the sources

A vulnerability has been found in gougucms up to 4.08.18. Impacted is the function Add of the file app/admin/controller/Level.php of the component User Level Handler. The manipulation of the argument Title leads to cross site scripting. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_