CVE-2026-9608

Vulnerability

The vulnerability is a stored cross-site scripting (XSS) in QianFox FoxCMS versions up to 1.2.6. The affected endpoint is /Tag/edit in the Administrator Backend. User input in the tag name field is not sanitized server-side and is stored in the database without proper HTML encoding. When an administrator views the tag list or related pages, the stored script executes. The issue also affects tag groups, hotword groups, and custom hotwords as detailed in the public issue report [2]. The vendor has not responded to the report [1].

Exploitation

An attacker needs access to the Administrator Backend, but the description states the attack can be launched remotely. Since the vulnerability is in the admin panel, an attacker would need valid admin credentials or trick an admin into performing actions. However, the issue report [2] demonstrates that the input length validation is only client-side, allowing an attacker to bypass it by modifying requests. The attacker can inject a payload such as `` into the tag name field. Upon saving, the payload is stored and executed when any admin visits the tag management page.

Impact

Successful exploitation leads to execution of arbitrary JavaScript in the context of the admin's browser. This can result in session hijacking, defacement, or theft of sensitive data displayed on the admin panel. The CVSS score is 2.4 (Low) due to the requirement of admin privileges and the limited scope of impact, but the stored nature increases persistence.

Mitigation

As of the publication date (2026-05-27), no official fix has been released. The vendor was informed via an issue report [2] but has not responded. Users should consider disabling the affected functionality or implementing a web application firewall (WAF) rule to block malicious payloads. Upgrading to a patched version is not possible until the vendor releases an update. The CVE is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.