CVE-2026-59078 · Other
NO FIX YET · SEE WHAT TO DO
Edito CMS does not properly sanitize avatar uploads, so HTML and JavaScript can be stored and then run in the browser of anyone who visits a URL pointing to the edited avatar. An attacker with an account can use this to run scripts in other visitors' browsers.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running Edito CMS where users can upload avatars, so any logged-in account can store markup that executes for visitors. Installations that do not allow avatar uploads or that run a fixed version are not exposed. Sources do not say which configuration options are required.
Not affected if fixed-version, no-avatar-upload
Who cares edito-cms, self-hosted
5.10.2607 or the hotfix for 5.85.10.2607 or later5.8) have also been released; exact hotfix version unknownEdito CMS is vulnerable to Stored XSS in avatar upload functionality. Authenticated attacker can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting an URL leading to a edited avatar.
This issue was fixed in version 5.10.2607. Hotfixes for older versions (5.8) have also been released.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.