---
id: "CVE-2026-129254"
page: "https://infrastack.ai/live/CVE-2026-129254"
kind: "vulnerability"
aliases: ["CVE-2026-129254"]
title: "Opixido OCMS: admin TUI image argument allows cross-site scripting"
severity: "medium"
cvss: 5.0
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Opixido OCMS", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["opixido-ocms", "other", "php", "self-hosted"]
not_affected_if: ["admin-not-public", "component-absent"]
published_at: "2026-11-14T13:17:21+00:00"
first_seen_at: "2026-11-14T13:28:09+00:00"
updated_at: "2026-11-14T13:29:10+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-129254", "first_seen_at": "2026-11-14T13:28:09+00:00"}]
exploit_sources: []
---

# Opixido OCMS: admin TUI image argument allows cross-site scripting

Link for people: https://infrastack.ai/live/CVE-2026-129254 (this .md is for agents)

An unknown function in the Admin TUI page admin/TUI/index.php of Opixido OCMS does not sanitize the img argument, so attacker-supplied script can run in a browser. The exploit is published, and the attack can be started remotely.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Opixido OCMS affected range not listed fixed no fixed version listed

## How to check

- Check whether your installation includes admin/TUI/index.php, for example with `ls admin/TUI/index.php` in the OCMS web root
- Determine the installed commit; the affected range is up to `b7c15660aba83d96677c1a9abaa69c082a24f21c`, and the sources give no version numbers beyond that

## Timeline

- 2026-11-14T13:28:09+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-129254

## From the sources

A flaw has been found in Opixido OCMS up to b7c15660aba83d96677c1a9abaa69c082a24f21c. This impacts an unknown function of the file admin/TUI/index.php of the component Admin TUI. This manipulation of the argument img causes cross site scripting. The attack can be initiated remotely. The exploit has been published and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_