PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-29934 Lightcms Project CVE debrief

CVE-2026-29934 is a reflected cross-site scripting (XSS) issue affecting Lightcms v2.0 in the /admin/menus component. According to the NVD record, the flaw can be triggered by modifying the Referer request header, allowing attacker-controlled script to run in the context of the victim’s browser.

Vendor
Lightcms Project
Product
Lightcms
CVSS
MEDIUM 6.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-26
Original CVE updated
2026-05-10
Advisory published
2026-03-26
Advisory updated
2026-05-10

Who should care

Administrators and security teams running Lightcms v2.0, especially if the /admin/menus interface is reachable by authenticated users. Web application defenders should also care because the issue affects browser-side execution in an administrative path.

Technical summary

The NVD entry classifies the issue as CWE-79 (Improper Neutralization of Input During Web Page Generation). The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating a network-exploitable reflected XSS that requires user interaction and can impact confidentiality and integrity in the browser context. The vulnerability is described as arising from unsafely handling the Referer header in /admin/menus.

Defensive priority

Medium: the vulnerability is user-interaction dependent, but it affects an admin-facing component and can execute arbitrary JavaScript in a browser session.

Recommended defensive actions

  • Review the /admin/menus code path for any use of the Referer header or other request headers in rendered output.
  • Apply context-appropriate output encoding and input validation for all reflected request data.
  • Confirm whether a vendor or project fix is available and deploy it to any affected Lightcms v2.0 instance.
  • Restrict access to administrative interfaces where practical, and monitor for unusual requests to /admin/menus.
  • Use browser-side and application-layer defenses such as CSP and secure session handling to reduce XSS impact.

Evidence notes

Supported by the NVD modified record for CVE-2026-29934, which lists Lightcms v2.0 as affected and classifies the weakness as CWE-79. The record also links to a GitHub issue (eddy8/LightCMS/issues/38) labeled as exploit/issue tracking/mitigation. No patch details, vendor advisory text, or proof-of-concept details were included in the supplied corpus.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-29934 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-29934

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-29934 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-29934

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.