{"id":"CVE-2026-59078","kind":"vulnerability","aliases":["CVE-2026-59078"],"related":[],"title":"Edito CMS: stored XSS through avatar upload lets attackers run scripts","description":"Edito CMS is vulnerable to Stored XSS in avatar upload functionality. Authenticated attacker can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting an URL leading to a edited avatar.\n\nThis issue was fixed in version 5.10.2607.  Hotfixes for older versions (5.8) have also been released.","summary":"Edito CMS does not properly sanitize avatar uploads, so HTML and JavaScript can be stored and then run in the browser of anyone who visits a URL pointing to the edited avatar. An attacker with an account can use this to run scripts in other visitors' browsers.","severity":"medium","cvss":5.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["edito-cms","other","self-hosted"],"not_affected_if":["fixed-version","no-avatar-upload"],"how_to_check":"- Check the installed Edito CMS version against the fixed release `5.10.2607` or the hotfix for `5.8`\n- Review whether user avatar uploads are enabled in the Edito CMS configuration (unknown if the sources name the setting)","fix":"- Upgrade Edito CMS to `5.10.2607` or later\n- Hotfixes for older versions (`5.8`) have also been released; exact hotfix version unknown","status":"open","published_at":"2026-11-13T08:17:17+00:00","first_seen_at":"2026-11-13T08:44:24+00:00","triaged_at":"2026-11-13T08:45:28+00:00","updated_at":"2026-11-13T08:45:28+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-13T08:45:28Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Edito CMS to `5.10.2607` or later\n- Hotfixes for older versions (`5.8`) have also been released; exact hotfix version unknown","reach":"internet","title":"Edito CMS: stored XSS through avatar upload lets attackers run scripts","impact":"medium","summary":"Edito CMS does not properly sanitize avatar uploads, so HTML and JavaScript can be stored and then run in the browser of anyone who visits a URL pointing to the edited avatar. An attacker with an account can use this to run scripts in other visitors' browsers.","audience":"businesses","category":"other","nicknames":[],"who_cares":["edito-cms","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker runs scripts in visitors' browsers, stealing sessions or actions","analyst_note":"Product ranges beyond the fixed version and hotfix details are not in the sources; check the vendor advisory if precise affected versions are needed.","how_to_check":"- Check the installed Edito CMS version against the fixed release `5.10.2607` or the hotfix for `5.8`\n- Review whether user avatar uploads are enabled in the Edito CMS configuration (unknown if the sources name the setting)","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["fixed-version","no-avatar-upload"],"who_is_affected":"Sites running Edito CMS where users can upload avatars, so any logged-in account can store markup that executes for visitors. Installations that do not allow avatar uploads or that run a fixed version are not exposed. Sources do not say which configuration options are required.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000765,"input_tokens":4563,"output_tokens":617,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-59078':14A,17A '5.10.2607':112C '5.8':117C 'account':61B 'also':119C 'anyon':47B 'arbitrari':87C 'attack':9A,58B,84C 'authent':83C 'avatar':6A,31B,56B,80C,105C 'browser':45B,71B 'cms':2A,20B,26B,73C 'cve':12A,15A 'edit':55B,104C 'edito':1A,19B,25B,72C 'edito-cm':18B 'fix':109C 'function':82C 'host':24B 'hotfix':113C 'html':34B,88C 'inject':86C 'issu':107C 'javascript':36B 'js':90C 'lead':101C 'let':8A 'older':115C 'point':52B 'proper':29B 'releas':121C 'rendered/executed':96C 'run':10A,42B,66B 'sanit':30B 'script':11A,67B 'self':23B 'self-host':22B 'store':3A,39B,77C 'upload':7A,32B,81C 'url':51B,100C 'use':63B 'version':111C,116C 'visit':49B,98C 'visitor':70B 'vulner':75C 'websit':92C 'xss':4A,78C","nicknames":[],"mitigations":[],"who_affected":"Sites running Edito CMS where users can upload avatars, so any logged-in account can store markup that executes for visitors. Installations that do not allow avatar uploads or that run a fixed version are not exposed. Sources do not say which configuration options are required.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["editocms","medium","other","selfhosted"],"campaign_type":null,"search_a":"'-2026':13A,16A '-59078':14A,17A 'attack':9A 'avatar':6A 'cms':2A 'cve':12A,15A 'edito':1A 'let':8A 'run':10A 'script':11A 'store':3A 'upload':7A 'xss':4A","search_b":"'account':61B 'anyon':47B 'attack':58B 'avatar':31B,56B 'browser':45B,71B 'cms':20B,26B 'edit':55B 'edito':19B,25B 'edito-cm':18B 'host':24B 'html':34B 'javascript':36B 'point':52B 'proper':29B 'run':42B,66B 'sanit':30B 'script':67B 'self':23B 'self-host':22B 'store':39B 'upload':32B 'url':51B 'use':63B 'visit':49B 'visitor':70B","search_c":"'5.10.2607':112C '5.8':117C 'also':119C 'arbitrari':87C 'attack':84C 'authent':83C 'avatar':80C,105C 'cms':73C 'edit':104C 'edito':72C 'fix':109C 'function':82C 'hotfix':113C 'html':88C 'inject':86C 'issu':107C 'js':90C 'lead':101C 'older':115C 'releas':121C 'rendered/executed':96C 'store':77C 'upload':81C 'url':100C 'version':111C,116C 'visit':98C 'vulner':75C 'websit':92C 'xss':78C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T08:17:17+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cvd@cert.pl","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-59078","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59078","severity":null,"published_at":"2026-11-13T08:17:17+00:00","modified_at":"2026-11-13T08:17:17+00:00","first_seen_at":"2026-11-13T08:44:24+00:00","fetched_at":"2026-11-13T08:44:24+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}