PT-2026-39138 · Brave Cms · Brave Cms

Smitocaru · Published 2026-05-08 · Updated 2026-05-26 · CVE-2026-41524

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Brave CMS versions prior to commit 6c56603

Description Page and article body content entered through the CKEditor rich-text editor is stored verbatim in the database and rendered using Laravel Blade's unescaped output directive {!! !!}. This allows an editor-role user to inject JavaScript or HTML that is permanently stored and executed in the browser of every visitor when the page loads.

Recommendations Update to the version containing commit 6c56603.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-41524

Affected Products

Brave Cms

References · 5

• 🔥 https://github.com/Ajax30/BraveCMS-2.0/security/advisories/GHSA-xj46-722x-6433 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-41524 · Security Note
• https://github.com/Ajax30/BraveCMS-2.0/commit/6c5660373cf5f0ca9181603280427aca46ef11ea · Note
• https://twitter.com/DFIR_Lab/status/2059088479007502363 · Twitter Post
• https://twitter.com/CVEnew/status/2052767575843721260 · Twitter Post