Cross-Site Scripting (XSS) in django-cms (CVE-2026-75526)
Summary
Cross-site scripting in django-cms (CVE-2026-75526). Risk of unauthorized operations or information disclosure. Exploitable via message. Mitigation: upgrade to 5.0.9 or later.
Original description
The description as published by the source.
Summary
When plugin rendering fails in edit mode, django CMS renders a cms-rendering-exception block so editors can see that a placeholder could not be rendered. Older code built that block's heading by interpolating the exception message, placeholder/source strings, and the failing plugin's short description directly into an HTML string, then returned the placeholder output as safe markup.
If an editor could store HTML in data used by a plugin's get_short_description() (or in other values interpolated into the exception message), and that plugin later raised during edit-mode rendering, the payload was parsed as HTML in the staff user's browser. This is a stored XSS condition in the CMS editing context.
Impact
The vulnerable path is only reached when placeholder rendering catches a plugin rendering exception:
try:
placeholder_content = "".join(plugin_content)
except Exception as e:
context["exc_info"] = sys.exc_info()
placeholder_content = self.render_exception("rendering placeholder", context, placeholder, editable)
render_exception() constructs a message from values that can include stored content:
value- the exception message.placeholder- the placeholder string representation.placeholder.source- the source object string representation, such as page content.instance.get_short_description()- plugin-provided summary text, often derived from plugin model fields.
In the vulnerable implementation, that messag…
Source: GitHub Security Advisories (Global) NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-75526 has been found in django-cms.
Attackers can target a specific entry point like message over the network to misuse the product.
Risk of unauthorized operations or information disclosure. CVSS score: 4.4/10.
What to do: upgrade django-cms to 5.0.9 or later.
If unsure, ask your IT team or search "django-cms CVE-2026-75526" on the vendor's site.
CVE-2026-75526 (django-cms) — CWE-79 / CVSS v3 4.4
Attack vector: remote (network-reachable)
Attack surface: message / value / placeholder / placeholder.source
Patched: 5.0.9 — apply immediately
Workaround: Until patched, reduce exposure by ensuring only fully trusted staff can edit plugins whose stored fields are included in get_short_description(), and fix or disable plugins that can be made to raise during edit-mode rendering.
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
Cross-site scripting (XSS) (CWE-79) exists in django-cms. Attackers reach the vulnerable code path via message.
Check the vendor advisory for the affected versions of django-cms. Attack surface: message / value / placeholder / placeholder.source.
Severity: Medium (CVSS 4.4/10). Risk of unauthorized operations or information disclosure.
Update to 5.0.9.
Workaround: Until patched, reduce exposure by ensuring only fully trusted staff can edit plugins whose stored fields are included in get_short_description(), and fix or disable plugins that can be made to raise during edit-mode rendering.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'django-cms' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'django-cms' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
django-cmsを grep し、稼働しているサービス・バージョンを把握する。 -
2Apply temporary workaround mitigate
Until patched, reduce exposure by ensuring only fully trusted staff can edit plugins whose stored fields are included in `get_short_description()`, and fix or disable plugins that can be made to raise during edit-mode rendering.パッチが適用されるまでの応急処置として、Until patched, reduce exposure by ensuring only fully trusted staff can edit plugins whose stored fields are included in
get_short_description(), and fix or disable plugins that can be made to raise during edit-mode rendering. を実施。回避策の副作用 (機能低下) を確認した上で。 -
3Apply patch patch
Upgrade django-cms to 5.0.9ステージング環境で 5.0.9 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
4Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。