Threats affecting pkg:github/ajax30/BraveCMS-2.0

Brave CMS is an open-source CMS. Prior to commit 6c56603, page and article body content entered through the CKEditor rich-text editor is stored verbatim in the database and subsequently rendered with Laravel Blade's unescaped output directive {!! !!}. Any JavaScript or HTML injected by an editor-role user is permanently stored and executed in every visitor's browser upon page load. This issue has been patched via commit 6c56603.

Brave CMS versions prior to 2.0.6 contain an Insecure Direct Object Reference (IDOR) vulnerability in the article image deletion feature. Authenticated users with edit permissions can delete images attached to articles owned by other users due to lack of ownership verification in the deleteImage method. This vulnerability allows unauthorized modification of content by bypassing authorization controls. The issue is fixed in version 2.0.6.

CVE-2026-35182 is a high-severity vulnerability in BraveCMS versions prior to 2.0.6. It involves a missing authorization check in the update role endpoint, allowing any authenticated user to escalate their privileges to Super Admin. The flaw exists because the POST route /rights/update-role/{id} does not enforce the required checkUserPermissions:assign-user-roles middleware. This vulnerability is fixed in BraveCMS version 2.0.6.

Brave CMS versions prior to 2.0.6 contain an unrestricted file upload vulnerability in the CKEditor upload functionality. The vulnerability exists because the ckupload method does not properly validate file types, allowing authenticated users to upload executable PHP scripts. This can lead to remote code execution on the affected system. The vulnerability is tracked as CVE-2026-35164 and has a high severity rating with a CVSS score of 8.8. A fix for this issue was introduced in version 2.0.6.

Brave CMS versions prior to 2.0.6 contain an unrestricted file upload vulnerability in the CKEditor endpoint. This flaw allows attackers to upload arbitrary files, including executable scripts, which can lead to remote code execution on the server. Successful exploitation may result in full system compromise, data exfiltration, or service disruption. The vulnerability is identified as CWE-434 and has a critical severity with a CVSS score of 9.3. A fix for this issue is available in Brave CMS version 2.0.6.