VYPR
← All advisories
Moderate severityNVD Advisory· Published Jun 17, 2025· Updated Jul 24, 2025

Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface

CVE-2025-6050

Description

Mezzanine CMS, in versions prior to 6.1.1, contains a Stored Cross-Site Scripting (XSS) vulnerability in the admin interface. The vulnerability exists in the "displayable_links_js" function, which fails to properly sanitize blog post titles before including them in JSON responses served via "/admin/displayable_links.js". An authenticated admin user can create a blog post with a malicious JavaScript payload in the title field, then trick another admin user into clicking a direct link to the "/admin/displayable_links.js" endpoint, causing the malicious script to execute in their browser.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Stored XSS in Mezzanine CMS <6.1.1 lets an admin inject JavaScript via blog post titles; fixed in 6.1.1.

Vulnerability

CVE-2025-6050 is a stored cross-site scripting (XSS) vulnerability in Mezzanine CMS versions prior to 6.1.1. The flaw exists in the displayable_links_js function, which constructs a JSON response for the /admin/displayable_links.js endpoint. Blog post titles are included in this response without proper sanitization, allowing an authenticated admin to inject malicious JavaScript into the title field [1][4].

Exploitation

To exploit the vulnerability, an admin user creates a blog post with a crafted JavaScript payload in the title. Another admin must then visit the /admin/displayable_links.js endpoint directly, causing the payload to execute in their browser [1]. The attack requires both authenticated admin users and social engineering to trick a victim admin into accessing the endpoint.

Impact

Successful exploitation allows the attacker's script to run in the context of the victim admin's session. This could lead to unauthorized actions within the admin interface, such as modifying content, creating new admin accounts, or exfiltrating sensitive data [1]. The risk is limited to admin users but undermines the trust and security of the admin panel.

Mitigation

The issue has been fixed in Mezzanine version 6.1.1 by applying Django's escape() function to sanitize the title value [1][4]. Users should upgrade to version 6.1.1 or later. The vulnerability is considered low severity as it requires admin privileges to exploit [1][3].

References
  1. NVD - CVE-2025-6050
  2. Stored Cross-Site Scripting (XSS) in admin interface - responsible disclosure · stephenmcd mezzanine · Discussion #2080
  3. fix: [security] fix XSS in admin · stephenmcd/mezzanine@898630d

AI Insight generated on May 19, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
MezzaninePyPI
< 6.1.16.1.1

Affected products

2

Patches

1
898630d8df48

fix: [security] fix XSS in admin

https://github.com/stephenmcd/mezzanineHenri HulskiJun 4, 2025via ghsa
commit
1 file changed · +2 −1
  • mezzanine/core/views.py+2 −1 modified
    @@ -14,6 +14,7 @@
 from django.template.loader import get_template
 from django.template.response import TemplateResponse
 from django.urls import reverse
+from django.utils.html import escape
 from django.utils.translation import gettext_lazy as _
 from django.views.decorators.csrf import requires_csrf_token
 
@@ -175,7 +176,7 @@ def displayable_links_js(request):
     # case of Page subclasses, we just use "Page", and then sort the items
     # by whether they're a Page subclass or not, then by their URL.
     for url, obj in Displayable.objects.url_map(for_user=request.user).items():
-        title = getattr(obj, "titles", obj.title)
+        title = escape(getattr(obj, "titles", obj.title))
         real = hasattr(obj, "id")
         page = is_page(obj)
         if real:

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.