InstantCMS has a Cross Site Scripting Vulnerability

Vulnerability

In InstantCMS versions prior to 2.16.3, the photo upload function in the photo album page lacks input validation on EXIF metadata fields [1]. Specifically, the Camera Model Name metadata is not sanitized before being stored and later rendered on the /photos/camera-{payload} page [2]. This allows an attacker to inject arbitrary HTML and JavaScript code into the application.

Exploitation

An attacker must have a valid user account (e.g., demo) and be able to upload an image file [2]. The attacker crafts an image with a malicious payload embedded in the Camera Model Name EXIF field, for example ` [2]. After uploading the image, the attacker navigates to the corresponding camera URL (e.g., /photos/camera-Amal_Test%3Cimg+src=%22asd%22+onerror=%22alert(1)%22%3E`) [2]. The payload is executed immediately in the browser of any user visiting that page because the server does not sanitize the metadata [2].

Impact

Successful exploitation results in stored cross-site scripting (XSS) [2]. An attacker can execute arbitrary JavaScript in the context of the victim's session, which can be used to steal cookies, redirect users to malicious sites, perform actions on the victim's behalf, log keystrokes, or deface the website [2]. No special network position is required beyond access to the web application, and the attack does not require user interaction beyond the victim visiting the crafted URL [2].

Mitigation

The vulnerability is fixed in InstantCMS version 2.16.3 [1]. The fix is implemented in commit e02de2f, which refactors the EXIF handling to sanitize input [1]. Users should upgrade to version 2.16.3 immediately. No workarounds are documented for earlier versions [2]. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog as of publication.