GHSA-vf6x-59hh-332f
Suggest an improvement- Source
- https://github.com/advisories/GHSA-vf6x-59hh-332f
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-vf6x-59hh-332f/GHSA-vf6x-59hh-332f.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-vf6x-59hh-332f
- Published
- 2025-03-01T00:11:46Z
- Modified
- 2026-02-18T23:55:33Z
- Severity
-
- 4.7 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
- Summary
- Formwork has a cross-site scripting (XSS) vulnerability in Site title
- Details
-
Summary
The site title field at /panel/options/site/allows embedding JS tags, which can be used to attack all members of the system. This is a widespread attack and can cause significant damage if there is a considerable number of users.
Impact
The attack is widespread, leveraging what XSS can do. This will undoubtedly impact system availability.
Patches
- Formwork 2.x (aa3e9c6) escapes site title from panel header navigation.
Details
By embedding "<!--", the source code can be rendered non-functional, significantly impacting system availability. However, the attacker would need admin privileges, making the attack more difficult to execute.
- Database specific
{ "cwe_ids": [ "CWE-80" ], "github_reviewed": true, "github_reviewed_at": "2025-03-01T00:11:46Z", "nvd_published_at": null, "severity": "MODERATE" }- References
Affected packages
Packagist / getformwork/formwork
Package
- Name
- getformwork/formwork
- Purl
- pkg:composer/getformwork/formwork