PT-2026-43211 · Xibo Cms · Xibo Cms

CVE-2026-42558 · Published 2026-05-26 · Updated 2026-06-11

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Xibo CMS versions prior to 4.4.2

Description A vulnerability chain involving Stored Cross-Site Scripting (XSS) and Iframe Sandbox escape exists in the Xibo CMS. Users with DataSet permissions can utilize the Data Connector functionality to craft messages that escape the sandbox and facilitate XSS. This exploitation requires an authorized user to possess specific privileges, such as the ability to use the "Add DataSet" button to create DataSets independently of Layouts, which are typically not granted to non-administrators by default.

Recommendations Upgrade to version 4.4.2. Revoke privileges related to the "Add DataSet" button from untrusted users as a temporary mitigation.

Exploit

Fix

XSS

Origin Validation Error

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-79

CWE-346

CWE-116

Related Identifiers

CVE-2026-42558

GHSA-6389-J56C-9FWW

Affected Products

Xibo Cms

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42558.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-42558 · Security Note
• https://osv.dev/vulnerability/CVE-2026-42558 · Vendor Advisory
• https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-6389-j56c-9fww · Note
• https://reddit.com/r/CVEWatch/comments/1to2dti/top_10_trending_cves_26052026 · Reddit Post
• https://reddit.com/r/CVEWatch/comments/1tp11qx/top_10_trending_cves_27052026 · Reddit Post
• https://t.me/cveNotify/166968 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2065017465365549483 · Twitter Post
• https://reddit.com/r/CVEWatch/comments/1tpz4cf/top_10_trending_cves_28052026 · Reddit Post