Cross Site Scripting in Omeka S

Executive Summary

CVE-2026-37710 is a Cross-Site Scripting (XSS) vulnerability in Omeka S versions before 4.2.1. It allows a remote attacker to execute arbitrary JavaScript code via the site navigation custom URL function by using the javascript: URI scheme. The vulnerability requires a user with permission to edit navigation URLs, such as an Editor role.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Omeka S version is prior to 4.2.1. Review navigation links for any URLs using the javascript: scheme. Inspect the application/src/Site/Navigation/Link/Url.php file for the isValid method to confirm if it blocks javascript URLs.

Useful 0 Not Useful 0

Impact Analysis

An attacker could trick an administrator into clicking a malicious navigation link, leading to arbitrary code execution. This could result in privilege escalation, data theft, or further compromise of the Omeka S system. The impact depends on the permissions of the targeted user.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection. Organizations using vulnerable Omeka S versions may face compliance violations, legal penalties, and reputational damage if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Omeka S to version 4.2.1 or later. Remove any existing navigation links containing javascript: URLs. Ensure only trusted users have permission to edit navigation links.

Useful 0 Not Useful 0