CVE-2026-32277: 
PHP vulnerability analysis and mitigation

CVE-2026-32277 is a DOM-based Cross-Site Scripting (XSS) vulnerability in the Cabinet Plugin list view of Connect-CMS, an open-source content management system developed by opensource-workshop. The vulnerability affects versions 1.35.0 through 1.41.0 (1.x series) and 2.35.0 through 2.41.0 (2.x series). It was discovered by Sho Odagiri of GMO Cybersecurity by Ierae, Inc. and disclosed on March 23, 2026, with patches released the same day. The vulnerability carries a CVSS v3.1 base score of 8.7 (High) (GitHub Advisory, Security Advisory).

The root cause is improper neutralization of user-controllable input during web page generation (CWE-79), specifically in how saved names (file/folder names) were rendered in the Cabinet Plugin list view. The vulnerable code used innerHTML with template literals to directly inject user-supplied content into the DOM — specifically, selectedList.innerHTML = this.selectedContents.map(name => \${name}`).join('')— without sanitization, enabling DOM-based XSS. The fix replacedinnerHTMLassignment with safe DOM manipulation usingdocument.createElementandtextContent`, which prevents script injection. Exploitation requires the attacker to be authenticated and able to access the Cabinet Plugin functionality, and also requires a victim user to interact with the crafted content (Security Advisory, Patch Commit).

Successful exploitation allows an authenticated attacker to inject and execute arbitrary JavaScript in the browsers of other users who view the Cabinet Plugin list view. This can lead to session hijacking, theft of sensitive data (e.g., cookies, credentials), unauthorized actions performed on behalf of victims, and defacement or manipulation of web content within the affected CMS. The vulnerability has a changed scope, meaning the impact extends beyond the attacker's own session to affect other users' browser contexts, with HIGH confidentiality and HIGH integrity impacts (GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.017% (4th percentile), indicating a low near-term probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires low-privilege authenticated access to the Connect-CMS instance and victim user interaction, which somewhat limits the attack surface (GitHub Advisory, Feedly).

1. Gain authenticated access: Obtain low-privilege credentials to a vulnerable Connect-CMS instance (versions 1.35.0–1.41.0 or 2.35.0–2.41.0) with access to the Cabinet Plugin.
2. Inject malicious payload: Create or rename a cabinet entry (file or folder) with a name containing a malicious JavaScript payload, such as <img src=x onerror=alert(document.cookie)> or a more sophisticated script designed to exfiltrate session tokens.
3. Trigger victim interaction: Lure a target user (e.g., an administrator) to navigate to the Cabinet Plugin list view where the maliciously named entry is displayed.
4. Script execution: When the victim's browser renders the list view, the unsafe innerHTML assignment processes the attacker-controlled name as HTML, executing the injected script in the victim's browser context.
5. Achieve objective: The executed script can steal session cookies, perform actions on behalf of the victim, or redirect the user to an attacker-controlled site (Security Advisory, Patch Commit).

• Logs: Web server access logs showing requests to Cabinet Plugin list view pages from unusual or unexpected authenticated users; CMS audit logs showing creation or renaming of cabinet entries with HTML/script-like characters in the name field.
• File System / Database: Cabinet entries in the database with names containing HTML tags (e.g., <script>, <img>, onerror=, javascript:) or encoded equivalents.
• Network: Outbound requests from victim browsers to attacker-controlled domains shortly after visiting the Cabinet Plugin list view; unexpected data exfiltration (e.g., cookie values) sent via HTTP GET parameters to external hosts.
• Browser / Application: Unexpected JavaScript alerts, redirects, or unauthorized actions occurring when authenticated users access the Cabinet Plugin list view.

The vendor has released patched versions that resolve this vulnerability: 1.41.1 for the 1.x series and 2.41.1 for the 2.x series. Administrators should upgrade immediately to one of these versions. As a temporary workaround if patching is not immediately possible, restrict access to the Cabinet Plugin to only highly trusted users. No configuration-only workaround fully mitigates the vulnerability without upgrading (Security Advisory, v1.41.1 Release, v2.41.1 Release).

The vulnerability was reported by Sho Odagiri of GMO Cybersecurity by Ierae, Inc. and acknowledged by the Connect-CMS maintainers (opensource-workshop) in the official security advisory. The Hacker Wire covered the disclosure shortly after publication. Social media activity was limited, with brief mentions on Mastodon and Bluesky from automated CVE tracking accounts. No significant broader industry commentary or media coverage has been identified (Security Advisory, The Hacker Wire).