CVE-2026-125082 · Package
NO FIX YET · SEE WHAT TO DO
FlyCMS, a PHP content management system, does not sanitize the content argument in its article insert path, so a crafted article body is rendered as active script. An attacker can run JavaScript in the browser of anyone who views the affected page.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running FlyCMS whose article rendering path displays user-supplied content on the detail page. Installs that do not use the article content feature, or that already carry the patch from commit 714521a9262e7bc9ca5713c873f57e96a4845352, are not exposed.
Not affected if patched-commit-714521a9
Who cares cms, flycms, php, self-hosted
articles/detail.html and ModelDataService.insertData in your FlyCMS install.e71738e0cfb7ffd48c2ce74242a2dbb43f84f25a or earlier.714521a9262e7bc9ca5713c873f57e96a4845352 exists; they give no fixed version because the product uses rolling releases.A security flaw has been discovered in sunkaifei FlyCMS up to e71738e0cfb7ffd48c2ce74242a2dbb43f84f25a. Affected by this vulnerability is the function ModelDataService.insertData of the file articles/detail.html of the component Content Rendering. Performing a manipulation of the argument content results in cross site scripting. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The patch is named 714521a9262e7bc9ca5713c873f57e96a4845352. It is recommended to apply a patch to fix this issue.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.