PT-2026-39140 · Brave Cms · Brave Cms

Smitocaru · Published 2026-05-08 · Updated 2026-05-26 · CVE-2026-41576

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Brave CMS versions prior to commit 6c56603

Description The contact form is publicly accessible without authentication. User-supplied message text is processed by the nl2br() function, which converts newlines to <br> tags but fails to escape HTML. This content is then rendered in a Blade email template using the unescaped {!! $msg !!} directive. Consequently, arbitrary markup can be injected into the email body. Although modern email clients generally block JavaScript, they still render HTML, allowing attackers to create phishing interfaces within emails sent to administrators.

Recommendations Update to the version containing commit 6c56603.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-41576

Affected Products

Brave Cms

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-41576 · Security Note
• https://github.com/Ajax30/BraveCMS-2.0/security/advisories/GHSA-x7cg-8grr-grvx · Note
• https://github.com/Ajax30/BraveCMS-2.0/commit/6c5660373cf5f0ca9181603280427aca46ef11ea · Note
• https://twitter.com/DFIR_Lab/status/2059098533542641911 · Twitter Post
• https://twitter.com/CVEnew/status/2052767574421852385 · Twitter Post