CVE-2020-23263
Description
Persistent Cross-site scripting vulnerability on Fork CMS version 5.8.2 allows remote attackers to inject arbitrary Javascript code via the "navigation_title" parameter and the "title" parameter in /private/en/pages/add.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
forkcms/forkcmsPackagist | < 5.8.3 | 5.8.3 |
Affected products
2- Fork CMS/Fork CMSdescription
Patches
Vulnerability mechanics
Root cause
"Missing HTML output encoding of the `navigation_title` and `title` parameters allows stored cross-site scripting."
Attack vector
An attacker with access to the Fork CMS backend can inject arbitrary JavaScript by supplying malicious input in the `navigation_title` or `title` parameters when adding or editing a page at `/private/en/pages/add`. Because the application fails to neutralize this input before rendering it in HTML output, the injected script executes in the context of any administrator who views the affected page tree or navigation. This is a classic stored cross-site scripting (XSS) attack [CWE-79].
Affected code
The vulnerability exists in `src/Backend/Modules/Pages/Engine/Model.php` where `navigation_title` and `title` values are output without sanitization in multiple methods (`createHtml`, `getPagesForDropdown`, `getSubTreeForDropdown`, `getSubtree`, `getTreeHTML`). The patch also fixes unsafe output in `src/Frontend/Core/Layout/Templates/Navigation.html.twig`, `src/Backend/Modules/Pages/Layout/Templates/Edit.html.twig`, `src/Frontend/Core/Header/MetaData.php`, and `src/Frontend/Core/Header/MetaLink.php`.
What the fix does
The patch wraps all unsafe `navigation_title` and `title` outputs with `htmlspecialchars()` (or the Twig `escape` filter) so that HTML metacharacters like `<`, `>`, `"`, and `&` are encoded as entities. In `Model.php`, seven locations now pass values through `htmlspecialchars()` before concatenation into HTML strings. The Twig templates switch from `|raw` to `|e('html')` (or `|escape`), and the `MetaData.php`/`MetaLink.php` files encode attribute values. These changes prevent the browser from interpreting attacker-supplied input as executable script tags.
Preconditions
- authAttacker must have access to the Fork CMS backend to add or edit pages (authenticated user with page editing privileges).
- configThe application must be running Fork CMS version 5.8.2 (or an earlier unpatched version).
- inputInput is supplied via the `navigation_title` or `title` parameters on the page add/edit form.
Generated on Jun 20, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
3- github.com/advisories/GHSA-vp4x-94ff-2cmvghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2020-23263ghsaADVISORY
- github.com/forkcms/forkcms/pull/3093ghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.