BraveCMS-2.0 versions before commit 6c56603 have an XSS vulnerability (CWE-79) in the contact form. The contact form is publicly accessible without authentication, and user input is processed by nl2br() which converts newlines to <br> tags but does not escape HTML entities. The unescaped input is then inserted into a Blade email template using the {!! $msg !!} directive, allowing arbitrary HTML injection into the email body. While JavaScript execution is generally blocked by modern email clients, the injected HTML can still be rendered, enabling attackers to create phishing-like content in emails sent to administrators. This vulnerability has been fixed in commit 6c56603.

The vulnerability allows attackers to inject arbitrary HTML into emails sent to administrators via the contact form. This can be leveraged to craft phishing interfaces within the email body, potentially deceiving recipients. The confidentiality of the system is at high risk due to possible phishing, but integrity impact is low and availability is unaffected. There are no known exploits in the wild as of the published date.

A patch addressing this vulnerability is available in commit 6c56603 of BraveCMS-2.0. Users should upgrade to this version or later to remediate the issue. Since the vendor advisory does not specify alternative mitigations, applying the official fix is recommended. Patch status is not explicitly confirmed beyond the commit reference; users should verify the vendor repository for the official patched version.