---
id: "CVE-2026-59076"
page: "https://infrastack.ai/live/CVE-2026-59076"
kind: "vulnerability"
aliases: ["CVE-2026-59076"]
title: "Edito CMS: stored script in profile names runs in admin browser"
severity: "medium"
cvss: 5.1
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["edito-cms", "other", "self-hosted"]
not_affected_if: ["auth-required", "fixed-version"]
published_at: "2026-11-13T08:17:17+00:00"
first_seen_at: "2026-11-13T08:44:24+00:00"
updated_at: "2026-11-13T08:45:29+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59076", "first_seen_at": "2026-11-13T08:44:24+00:00"}]
exploit_sources: []
---

# Edito CMS: stored script in profile names runs in admin browser

Link for people: https://infrastack.ai/live/CVE-2026-59076 (this .md is for agents)

An authenticated user can save a script in the givenName or surname profile fields through the /api/auth/profile endpoint. When an administrator opens the admin changelog logs, that script runs in the administrator's browser.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Edito CMS version and compare it with the fixed release `5.10.2607` (or the 5.8 hotfix)
- Review user profile names for script-like content, if you run Edito CMS

## Fix

- Edito CMS `5.10.2607` (source states this version fixes the issue)
- Hotfixes for older versions such as 5.8 have also been released (versions not specified beyond 5.8)

## Timeline

- 2026-11-13T08:44:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-59076

## From the sources

Edito CMS is vulnerable to Stored Cross-Site Scripting (XSS). Due to improper input validation, an authenticated attacker can inject malicious scripts into givenName and surname parameters via the /api/auth/profile endpoint. When an administrator visits the admin changelog logs, the injected script is automatically executed, in his browser.


This issue was fixed in version 5.10.2607.  Hotfixes for older versions (5.8) have also been released.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_