What is GHSA-39g8-j5g5-gfjq?

GHSA-39g8-j5g5-gfjq is a security advisory published by GitHub Security Advisories with Medium severity. Cloudron 9.1.7 and 9.2 contain a stored cross-site scripting (XSS) vulnerability in the Branding...

Which CVE IDs does GHSA-39g8-j5g5-gfjq cover?

GHSA-39g8-j5g5-gfjq covers the following CVE IDs: CVE-2026-79363. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-39g8-j5g5-gfjq?

GHSA-39g8-j5g5-gfjq has a CVSS v3 base score of 5.9, published by GitHub Security Advisories.

GHSA-39g8-j5g5-gfjqMediumCVSS 5.9

Cloudron 9.1.7 and 9.2 contain a stored cross-site scripting (XSS) vulnerability in the Branding...

Vendor

GitHub Security Advisories

Published

October 9, 2026

Last Modified

October 9, 2026

🔗 CVE IDs covered (1)

CVE-2026-79363 →

📋 Description

Cloudron 9.1.7 and 9.2 contain a stored cross-site scripting (XSS) vulnerability in the Branding Footer feature. An authenticated administrator can store crafted HTML containing JavaScript event handlers in the Footer setting. The stored value is rendered without sufficient sanitization on the public login / OpenID interaction page and in the System Event Log, causing attacker-controlled JavaScript to execute in the Cloudron web origin when an affected page is viewed.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-79363
https://www.faydin.blog/cves/cves.html
https://www.faydin.blog/en/cves/CVE-2026-79363
https://github.com/advisories/GHSA-39g8-j5g5-gfjq