GHSA-58h5-h554-429q: 
PHP vulnerability analysis and mitigation

A critical Cross-Site Scripting (XSS) vulnerability was discovered in ezplatform-admin-ui affecting versions >= 2.3.0 and < 2.3.26. The vulnerability (GHSA-58h5-h554-429q) was disclosed on November 10, 2022, and allows for JavaScript injection in the content type entries 'name' and 'short name' fields (GitHub Advisory, Ibexa Advisory).

The vulnerability allows malicious actors to inject JavaScript code through the content type entries specifically in the 'name' and 'short name' fields. The issue was patched in version 2.3.26 by implementing proper escaping of injected content (GitHub Advisory).

The vulnerability could allow attackers with content type editing permissions to execute arbitrary JavaScript code in the context of other users' browsers who access the affected content types. While the impact is significant, it is somewhat limited by the requirement of having content type editing permissions (Ibexa Advisory).

The vulnerability has been fixed in version 2.3.26 of ezplatform-admin-ui. Organizations should upgrade to this version or later to receive the security fix. The patch ensures that any injected content is properly escaped (GitHub Advisory).