The flaw allows an attacker to place arbitrary HTML into the contact form’s message field. The input is converted with nl2br() without sanitization and then inserted into a Blade email template through an unescaped directive, resulting in stored HTML injection. This can lead to phishing interfaces rendered to administrators, exploiting the fact that many email clients display HTML even if they block scripts.

Ajax30’s open-source BraveCMS version 2.0, where the public contact form lacks authentication and outputs user input into email bodies.

With a CVSS score of 7.1 the vulnerability is considered high. Although an EPSS score is not available and the issue is not listed in CISA KEV, the lack of authentication on the form means any web visitor can inject malicious content. Attackers can craft visually convincing phishing emails that reach site administrators, potentially compromising credentials or malware distribution.