CVE-2026-96739
Received Received - Intake

SEMCMS Cross Site Scripting via imgFile Parameter

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: VulDB

Description
A flaw has been found in SEMCMS up to 4.2. Affected by this issue is some unknown functionality of the file /Edit/php/upload_json.php of the component KindEditor Upload Interface. This manipulation of the argument imgFile causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-96739
EUVD
EUVD-2026-85737

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
semcms semcms to 4.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a stored cross-site scripting (XSS) flaw in SEMCMS version 4.2 or earlier. It exists in the KindEditor Upload Interface file /Edit/php/upload_json.php. The issue allows remote attackers to upload malicious HTML files without authentication or permission checks. These files are stored in a web-accessible directory and served as text/html, enabling attackers to execute scripts when users access them.

Detection Guidance

Check for unauthorized HTML file uploads in the /Edit/php/upload_json.php endpoint. Look for files with .html extensions in web-accessible directories like /Images/attached/. Use tools like curl to test if the upload interface accepts HTML files without authentication. Example command: curl -X POST -F 'imgFile=@test.html' http://target/Edit/php/upload_json.php

Monitor network traffic for POST requests to /Edit/php/upload_json.php with HTML file uploads. Inspect server logs for unusual file uploads or access to /Images/attached/ paths.

Impact Analysis

An attacker could upload an HTML file containing malicious JavaScript. When a logged-in user or administrator accesses the file, the script executes under the website's domain. This could allow attackers to host fake pages, modify trusted content, steal cookies, or send same-origin requests. The impact includes potential data theft, session hijacking, or defacement of the website.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive user data, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Non-compliance may result in legal penalties, fines, or reputational damage due to insufficient security measures to protect user data.

Mitigation Strategies

Disable or restrict access to the /Edit/php/upload_json.php endpoint until a patch is available. Implement strict file type validation to block HTML uploads. Require authentication and authorization checks before allowing file uploads.

Isolate uploaded files in a non-web-accessible directory. Apply CSRF protection to prevent unauthorized uploads. Regularly audit web directories for unexpected HTML files.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-96739. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart