What is GHSA-jp3f-93v6-xm3f?

GHSA-jp3f-93v6-xm3f is a security advisory published by GitHub Security Advisories with Medium severity. Magnolia CMS is vulnerable to Stored XSS in import functionality. An attacker with editor...

Which CVE IDs does GHSA-jp3f-93v6-xm3f cover?

GHSA-jp3f-93v6-xm3f covers the following CVE IDs: CVE-2026-18478. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-jp3f-93v6-xm3fMedium

Magnolia CMS is vulnerable to Stored XSS in import functionality. An attacker with editor...

Vendor

GitHub Security Advisories

Published

August 10, 2026

Last Modified

August 10, 2026

🔗 CVE IDs covered (1)

CVE-2026-18478 →

📋 Description

Magnolia CMS is vulnerable to Stored XSS in import functionality. An attacker with editor privileges can inject arbitrary HTML and JS into the name of uploaded image, which will be rendered/executed when opening uploaded image.

The issue was fixed in version 6.3.10

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2026-18478
https://cert.pl/en/posts/2026/08/CVE-2026-18478
https://docs.magnolia-cms.com/product-docs/6.3/releases/release-notes-for-magnolia-cms-6.3.10
https://www.magnolia-cms.com
https://github.com/advisories/GHSA-jp3f-93v6-xm3f