CVE-2026-41576

{
  "id": "CVE-2026-41576",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-08T15:16:40.910",
  "lastModified": "2026-10-26T18:10:00.173",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Brave CMS is an open-source CMS. Prior to commit 6c56603, the contact form is publicly accessible (no authentication required). User-supplied message text is passed through PHP's nl2br() function, which converts newlines to <br> tags but does not escape HTML. The resulting string is then passed to a Blade email template using the unescaped {!! $msg !!} directive. The resulting content is then rendered in a Blade email template using the unescaped {!! $msg !!} directive. Because HTML is not sanitized, arbitrary markup can be injected into the email body. While modern HTML-capable email clients (Gmail or Outlook Web) typically block JavaScript execution, they still render HTML content. This allows attackers to craft convincing phishing interfaces inside the email sent to the administrator. This issue has been patched via commit 6c56603."
    },
    {
      "lang": "es",
      "value": "Brave CMS es un CMS de código abierto. Antes del commit 6c56603, el formulario de contacto es de acceso público (no se requiere autenticación). El texto del mensaje proporcionado por el usuario se pasa a través de la función nl2br() de PHP, que convierte los saltos de línea en etiquetas [br] pero no escapa el HTML. La cadena resultante se pasa luego a una plantilla de correo electrónico de Blade utilizando la directiva sin escapar {!! $msg !!}. El contenido resultante se renderiza luego en una plantilla de correo electrónico de Blade utilizando la directiva sin escapar {!! $msg !!}. Debido a que el HTML no está sanitizado, se puede inyectar marcado arbitrario en el cuerpo del correo electrónico. Aunque los clientes de correo electrónico modernos con capacidad HTML (Gmail o Outlook Web) suelen bloquear la ejecución de JavaScript, aún renderizan contenido HTML. Esto permite a los atacantes crear interfaces de phishing convincentes dentro del correo electrónico enviado al administrador. Este problema ha sido parcheado mediante el commit 6c56603."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Ajax30",
          "product": "BraveCMS-2.0",
          "versions": [
            {
              "version": "< 6c5660373cf5f0ca9181603280427aca46ef11ea",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-13T16:09:54.844947Z",
          "id": "CVE-2026-41576",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/Ajax30/BraveCMS-2.0/commit/6c5660373cf5f0ca9181603280427aca46ef11ea",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/Ajax30/BraveCMS-2.0/security/advisories/GHSA-x7cg-8grr-grvx",
      "source": "[email protected]"
    }
  ]
}