CVE-2026-79363: n/a

CVE-2026-79363 describes a stored XSS vulnerability affecting Cloudron 9.1.7 and 9.2. The flaw exists in the Branding Footer feature where an authenticated administrator can input crafted HTML containing JavaScript event handlers into the Footer setting. This input is stored and later rendered on the public login/OpenID interaction page and the System Event Log without sufficient sanitization, enabling execution of attacker-controlled JavaScript in the context of the Cloudron web origin.

Successful exploitation allows an attacker with administrator authentication to execute arbitrary JavaScript in the context of the Cloudron web origin. This could lead to session hijacking, unauthorized actions, or other attacks leveraging the victim's browser context when viewing affected pages. The vulnerability requires administrator-level authentication to inject the malicious payload.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted personnel only and avoid viewing the affected pages with untrusted accounts. Monitor vendor communications for updates on official patches or mitigations.