CVE-2026-22587
Stored XSS in Ideagen DevonWay Reports Allows Remote Code Execution
Publication date: 2026-01-08
Last updated on: 2026-01-08
Assigner: Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ideagen | devonway | 2.62.4 |
| ideagen | devonway | 2.62 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a stored cross-site scripting (XSS) issue in Ideagen DevonWay. A remote, authenticated attacker can create a malicious payload on the 'Reports' page, which will execute when another user views that report.
How can this vulnerability impact me? :
The vulnerability allows an attacker to execute malicious scripts in the context of another user's browser when they view a crafted report. This can lead to unauthorized actions, data theft, or session hijacking for affected users.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is fixed in Ideagen DevonWay versions 2.62.4 and 2.62 LTS. Immediate mitigation steps include upgrading your Ideagen DevonWay installation to one of these fixed versions.