CVE-2026-82664
Received Received - Intake

Cross-Site Scripting in GEOFlow up to 2.1.0

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: VulDB

Description
A security vulnerability has been detected in yaojingang GEOFlow up to 2.1.0. This affects an unknown part of the file app/Http/Controllers/Site/HomeController.php of the component JSON-LD Theme Handler. The manipulation of the argument Search leads to cross site scripting. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.1.1 is able to mitigate this issue. The identifier of the patch is 67abfd864a15d169a78429f3290c91cb3b93e849. Upgrading the affected component is recommended.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-82664
EUVD
EUVD-2026-68432

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
yaojingang geoflow to 2.1.0 (inc)
yaojingang geoflow 2.1.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Cross-Site Scripting (XSS) flaw in yaojingang GEOFlow versions up to 2.1.0. It exists in the file app/Http/Controllers/Site/HomeController.php where the 'Search' argument is improperly handled. Attackers can inject malicious scripts via this parameter, which are then executed in a victim's browser. The issue arises because user input is rendered inside a JSON-LD script block without proper escaping.

Detection Guidance

This vulnerability involves Cross-Site Scripting (XSS) in GEOFlow up to 2.1.0 via the Search parameter in JSON-LD Theme Handler. To detect it, inspect HTTP requests containing the Search parameter for unsanitized user input in responses. Check if user-controlled input appears in <script type="application/ld+json"> blocks without proper escaping. Review server logs for unusual activity or requests targeting the HomeController.php file.

Impact Analysis

This XSS vulnerability allows attackers to execute arbitrary JavaScript in the context of a user's browser session. This could lead to theft of session cookies, account takeover, or defacement of the website. Since the attack is remote and requires no authentication, any user visiting a compromised page could be affected.

Mitigation Strategies
  • Upgrade GEOFlow to version 2.1.1 or later to apply the patch for this XSS vulnerability.
  • Apply the security fixes from pull request #61, which includes hardening JSON-LD rendering to prevent XSS.
  • Enter maintenance mode, run migrations with confirmation, and verify readiness before proceeding with the upgrade.
  • Disable telemetry temporarily during the upgrade process if enabled, using GEOFLOW_TELEMETRY_ENABLED=false.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82664. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart