GHSA-7j46-f57w-76pj — Formwork CMS has Stored Cross-Site Scripting Vulnerebility in Blog Tags

Formwork CMS has Stored Cross-Site Scripting Vulnerebility in Blog Tags

The advisory, in context

Summary

Inserting unsanitized data into the blog tag field in Formwork CMS results in stored cross‑site scripting (XSS). Any user with credentials to the Formwork CMS who accesses or edits an affected blog post will have attacker‑controlled script executed in their browser. Because the issue is persistent and impacts privileged administrative workflows, the severity is elevated.

Details

Formwork CMS fails to properly sanitize data inserted into tags, before saving them and rendering them into the edit blog interface. When a specially crafted tag becomes saved as a tag into the system, it is unable to be removed. Any attempt to remove the tag from the affected post, causes the XSS to trigger once again.

Additionally, once the malicious tag is present, managing standard tags becomes impossible. This is due to script execution on attempted modification. This leads to a form of interface lockout where the payload continually reinserts itself due to the stored, unsafe rendering.

Impact

This is a stored cross‑site scripting (XSS) vulnerability.

This impacts all users who access the affected blog post’s edit page.

Patches

Formwork 2.2.0 ensures proper escaping of user input in tag fields.

Affected packages

Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.

getformwork/formwork Packagist

Ecosystem versions

Earlier releases before 2.2.0

Fixed in 2.2.0

78 explicitly affected versions

0.10.0, 0.10.1, 0.10.2, 0.10.3, 0.10.4, 0.10.5, 0.11.0, 0.11.1, 0.11.2, 0.12.0, 0.12.1, 0.6.10, 0.6.11, 0.6.12, 0.6.9, 0.7.0, 0.7.1, 0.7.2, 0.8.0, 0.8.1, 0.9.0, 0.9.1, 0.9.2, 0.9.3, 0.9.4, 0.9.5, 0.9.6, 1.0.0, 1.1.0, 1.1.1, 1.10.0, 1.10.1, 1.10.2, 1.10.3, 1.11.0, 1.11.1, 1.12.0, 1.12.1, 1.13.0, 1.13.1, 1.13.2, 1.2.0, 1.2.1, 1.3.0, 1.3.1, 1.4.0, 1.4.1, 1.4.2, 1.4.3, 1.4.4, 1.4.5, 1.4.6, 1.4.7, 1.5.0, 1.5.1, 1.5.2, 1.6.0, 1.6.1, 1.7.0, 1.7.1, 1.8.0, 1.9.0, 1.9.1, 2.0.0, 2.0.0-beta.1, 2.0.0-beta.2, 2.0.0-beta.3, 2.0.0-beta.4, 2.0.0-beta.5, 2.0.0-beta.6, 2.0.0-rc.1, 2.0.1, 2.1.0, 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.1.5

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "2.2.0"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "0.10.0",
    "0.10.1",
    "0.10.2",
    "0.10.3",
    "0.10.4",
    "0.10.5",
    "0.11.0",
    "0.11.1",
    "0.11.2",
    "0.12.0",
    "0.12.1",
    "0.6.10",
    "0.6.11",
    "0.6.12",
    "0.6.9",
    "0.7.0",
    "0.7.1",
    "0.7.2",
    "0.8.0",
    "0.8.1",
    "0.9.0",
    "0.9.1",
    "0.9.2",
    "0.9.3",
    "0.9.4",
    "0.9.5",
    "0.9.6",
    "1.0.0",
    "1.1.0",
    "1.1.1",
    "1.10.0",
    "1.10.1",
    "1.10.2",
    "1.10.3",
    "1.11.0",
    "1.11.1",
    "1.12.0",
    "1.12.1",
    "1.13.0",
    "1.13.1",
    "1.13.2",
    "1.2.0",
    "1.2.1",
    "1.3.0",
    "1.3.1",
    "1.4.0",
    "1.4.1",
    "1.4.2",
    "1.4.3",
    "1.4.4",
    "1.4.5",
    "1.4.6",
    "1.4.7",
    "1.5.0",
    "1.5.1",
    "1.5.2",
    "1.6.0",
    "1.6.1",
    "1.7.0",
    "1.7.1",
    "1.8.0",
    "1.9.0",
    "1.9.1",
    "2.0.0",
    "2.0.0-beta.1",
    "2.0.0-beta.2",
    "2.0.0-beta.3",
    "2.0.0-beta.4",
    "2.0.0-beta.5",
    "2.0.0-beta.6",
    "2.0.0-rc.1",
    "2.0.1",
    "2.1.0",
    "2.1.1",
    "2.1.2",
    "2.1.3",
    "2.1.4",
    "2.1.5"
  ]
}

Set up in your agent.

Investigate in your agent.