Mayan EDMS Tag XSS

Vulnerability

Overview

CVE-2022-47419 is a stored cross-site scripting (XSS) vulnerability in Mayan EDMS, an open-source document management system. The flaw resides in the in-product tagging system, where tag labels are not properly sanitized before being rendered in the Select2 user interface widget. This allows an authenticated user with sufficient privileges to inject arbitrary HTML or JavaScript code that persists within the application [2][3].

Exploitation

Successful exploitation requires a privileged account — it is not possible for guest, anonymous, or unauthenticated visitors to trigger the vulnerability. An attacker must have access to the tagging feature and create or modify a tag label containing malicious script content. The injected code executes when other users interact with the tag selection interface (e.g., attaching or removing tags from documents) [3]. The vendor states that the attack cannot bypass Mayan EDMS's access controls or expose arbitrary information outside the tagging context [3].

Impact

While the XSS can execute arbitrary JavaScript in the context of the victim's session, the vendor notes that the impact is limited. Because Mayan EDMS uses Django with SESSION_COOKIE_HTTPONLY enabled by default since version 1.4 (March 2012), session cookies are not accessible via JavaScript, preventing standard session theft via this XSS. The vulnerability is reported as a “limited scope weakness of the tagging system markup” that can display arbitrary text when selecting tags [3].

Mitigation

Version 4.3.6 of Mayan EDMS backports the fix by sanitizing tag labels in the Select2 widget template [3]. Users are advised to upgrade to this release or later. No workarounds are provided for earlier versions. The issue was disclosed by Rapid7 researcher Matthew Kienow; the vendor did not respond to initial disclosure attempts but later released the patch [1][3].