PT-2026-57973 · Nukeviet · Nukeviet

CVE-2026-48118 · Published 2026-07-13 · Updated 2026-07-13

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions NukeViet (affected versions not specified)

Description Reflected Cross-Site Scripting (XSS) exists in the Comment module. The issue occurs because the status comment parameter accepts base64-encoded HTML or JavaScript that is decoded server-side and rendered without escaping in the page. The vulnerability is exacerbated by a flaw where the checkss anti-forgery token is derived from a static site-wide value NV CACHE PREFIX instead of a per-session value, allowing the token to be reused across different users.

Technical details include:

• API Endpoint: /index.php (when nv=comment and comment load=1 are set)
• Vulnerable Parameters: status comment and checkss

Real-world impact was verified through a phishing overlay that captured plaintext credentials and transmitted them to an external server. No authentication is required to exploit this issue.

Recommendations

• Replace NV CACHE PREFIX with NV CHECK SESSION in all locations that generate or validate the checkss token to bind it to the user session.
• Apply nv htmlspecialchars() to the result of the nv base64 decode() function for the status comment parameter before it is assigned to the template.
• As a temporary mitigation, restrict access to the Comment module or avoid using the status comment parameter.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-48118

GHSA-MXPF-QGG6-V3FF

Affected Products

Nukeviet

References · 3

• https://osv.dev/vulnerability/GHSA-mxpf-qgg6-v3ff · Vendor Advisory
• https://github.com/nukeviet/nukeviet/security/advisories/GHSA-mxpf-qgg6-v3ff · Note
• https://github.com/nukeviet/nukeviet · Note