Description
Cloudron 9.1.7 and 9.2 contain a stored cross-site scripting (XSS) vulnerability in the Branding Footer feature. An authenticated administrator can store crafted HTML containing JavaScript event handlers in the Footer setting. The stored value is rendered without sufficient sanitization on the public login / OpenID interaction page and in the System Event Log, causing attacker-controlled JavaScript to execute in the Cloudron web origin when an affected page is viewed.
Published: 2026-10-09
Score: 5.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Stored XSS causing script execution in the Cloudron web origin
Action: Apply Patch
AI Analysis

Impact

Cloudron versions 9.1.7 and 9.2 contain a stored cross‑site scripting flaw (CWE-79) in the Branding Footer feature. An authenticated administrator can save arbitrary HTML that includes JavaScript event handlers in the Footer setting. When a user views the public login or OpenID interaction page or the System Event Log, the stored value is rendered without proper sanitization, causing the browser to execute the attacker‑supplied JavaScript inside the Cloudron web origin, leading to potential arbitrary code execution within that origin.

Affected Systems

The only affected product is Cloudron, specifically the 9.1.7 and 9.2 releases. No other versions or products are listed as impacted in the advisory.

Risk and Exploitability

The vulnerability requires attacker ownership of administrator credentials to inject malicious footer content. Once injected, any user who accesses the affected pages will execute the payload. The CVSS score of 5.9 indicates moderate severity, and the EPSS score is not available, leaving the likelihood of exploitation uncertain. The issue is not listed in the CISA KEV catalog.

Generated by OpenCVE AI on October 10, 2026 at 00:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Cloudron to any version later than 9.2, which removes the vulnerable footer handling logic
  • If an upgrade is not immediately possible, clear or disable the Branding Footer setting to eliminate the stored payload
  • Reset the Footer setting to its default value to ensure no existing malicious content remains
  • Check the Cloudron website for the latest security updates or patches.

Generated by OpenCVE AI on October 10, 2026 at 00:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 10 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 10 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Title Stored XSS in Cloudron Branding Footer Enables Script Execution

Fri, 09 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L'}

Fri, 09 Oct 2026 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Cloudron
Cloudron cloudron
Vendors & Products Cloudron
Cloudron cloudron

Fri, 09 Oct 2026 16:15:00 +0000

Type Values Removed Values Added
Title Stored XSS in Cloudron Branding Footer Enables Script Execution
Weaknesses CWE-79

Fri, 09 Oct 2026 14:15:00 +0000

Type Values Removed Values Added
Description Cloudron 9.1.7 and 9.2 contain a stored cross-site scripting (XSS) vulnerability in the Branding Footer feature. An authenticated administrator can store crafted HTML containing JavaScript event handlers in the Footer setting. The stored value is rendered without sufficient sanitization on the public login / OpenID interaction page and in the System Event Log, causing attacker-controlled JavaScript to execute in the Cloudron web origin when an affected page is viewed.
References

Subscriptions

Cloudron Cloudron
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-10-09T20:46:49.943Z

Reserved: 2026-08-25T00:00:00.000Z

Link: CVE-2026-79363

cve-icon Vulnrichment

Updated: 2026-10-09T20:45:38.480Z

cve-icon NVD

Status : Deferred

Published: 2026-10-09T14:17:22.777

Modified: 2026-10-09T21:17:06.170

Link: CVE-2026-79363

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-10T00:30:09Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')