CVE-2026-4846

Vulnerability

Description

A reflected cross-site scripting (XSS) vulnerability exists in MuuCmf T6 version 1.9.5.20260309, specifically in the file channel/admin.Account/autoReply.html. The keyword` parameter is used unsanitized in line 31 of the template, reflecting user input directly into the page without proper filtering or encoding [1]. This allows an attacker to inject arbitrary HTML and JavaScript code into the response.

Exploitation

The attack is performed remotely by crafting a URL parameter. The attacker can craft a malicious link to /channel/admin.Account/autoReply.html?keyword=<script>alert(1)</script> and send it to a victim. No authentication is required for the attack to succeed, and the user interaction is limited to clicking the malicious link [1].

Impact

Successful exploitation leads to arbitrary JavaScript execution in the victim's browser, potentially allowing session hijacking, redirection to malicious sites, or other client-side attacks. The official CVSS score for this vulnerability is 8.8 (High) AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating high impact to confidentiality, integrity, and availability [1].

Mitigation

The vendor was contacted but did not respond. As of this writing, no official patch is available [1]. Users are advised to manually sanitize the input parameter (e.g., by using htmlspecialchars() in PHP) or implement web application firewall rules to block XSS attempts until a fix is released.