CVE-2026-18478 describes a stored XSS vulnerability in Magnolia CMS affecting version 6.3.0. The vulnerability arises from improper neutralization of input during web page generation (CWE-79). Specifically, an attacker with editor privileges can inject malicious HTML and JavaScript code into the name field of an uploaded image. When the uploaded image is viewed, the injected code executes in the context of the victim's browser. The vulnerability has a CVSS 4.0 base score of 5.1, indicating medium severity. The issue was resolved in Magnolia CMS version 6.3.10.

Successful exploitation allows an attacker with editor privileges to execute arbitrary HTML and JavaScript in the context of users viewing the uploaded image, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability requires the attacker to have editor privileges and user interaction (viewing the image) to trigger the payload.

This vulnerability is fixed in Magnolia CMS version 6.3.10. Users should upgrade to version 6.3.10 or later to remediate the issue. No other official remediation or temporary fixes are documented. Patch status is confirmed by the vendor's versioning information.