XSS in Owen2345 Camaleoncms
CVE-2026-73329
CamaleonCMS contains a stored cross-site scripting vulnerability that allows authenticated low-privileged users to execute arbitrary JavaScript in an administrator's browser by injecting unsanitized HTML payloads into the post title parameter during draft creation. Attackers can submit a malicious HTML payload as a draft title through the drafts creation endpoint, which is persisted to the database without escaping and later rendered as raw HTML in the admin drafts listing, enabling administrator session compromise, cookie theft, and forged authenticated requests.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.7 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N.
EPSS exploit prediction
EPSS: 0.004 (33.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 33rd percentile — 33.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.004 · change: +0.002
Affected products
- Owen2345 Camaleoncms — versions 0
Weakness classification (CWE)
References
- github.com/owen2345/camaleon-cms (product, patch)
- enrik-m.github.io/posts/Camaleon-CMS-Vulnerabilties/ (product)
- www.vulncheck.com/advisories/camaleoncms-stored-xss-via-draft-post-title-creati… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-73329?
- CVE-2026-73329 is a high-severity vulnerability in Owen2345 Camaleoncms, classified under Cross-site Scripting. CVSS score: 8.7/10. Published 2026-08-12.
- How severe is CVE-2026-73329?
- High severity. CVSS v3 base score is 8.7 out of 10.