CVE-2026-85382: Cross Site Scripting in light0011 cms

This vulnerability affects the light0011 cms, specifically the function htmlspecialchars_decode in the file App/Home/View/Default/Chapter/oneChapter.tpl. Manipulating the content argument in this function can lead to cross-site scripting, enabling remote attackers to execute arbitrary scripts in the context of the affected application. The vulnerability has been publicly disclosed with exploit code available. Due to the rolling release approach of the product, no explicit affected or fixed versions are provided. The vendor has not yet responded to the issue report.

Successful exploitation allows remote attackers to perform cross-site scripting attacks, potentially leading to script execution in users' browsers. This can result in session hijacking, defacement, or other client-side impacts. The vulnerability does not require privileges or user interaction beyond visiting a crafted page, but user interaction is needed (UI:P). The CVSS score of 5.3 reflects a medium severity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch links are available, users should apply standard XSS mitigations such as input validation and output encoding where possible. Monitor official channels for updates or fixes from the vendor.