PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-9608 QianFox CVE debrief

A stored cross-site scripting (XSS) vulnerability exists in QianFox FoxCMS versions up to and including 1.2.6. The affected endpoint is `/Tag/edit` within the Administrator Backend component. Successful exploitation requires high privileges (administrator access) and user interaction, limiting the attack surface to authenticated administrative sessions. The vulnerability has been publicly disclosed via a GitHub issue report, and the vendor has not responded to date. The CVSS 4.0 score of 1.9 reflects the restricted attack vector requiring privileged access and user interaction, with limited integrity impact.

Vendor
QianFox
Product
FoxCMS
CVSS
LOW 1.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-07-23
Advisory published
2026-05-27
Advisory updated
2026-07-23

Who should care

Organizations running FoxCMS ≤1.2.6 with exposed administrative interfaces; security teams managing CMS deployments; developers maintaining FoxCMS instances.

Technical summary

The vulnerability exists in an unknown function within `/Tag/edit` of the FoxCMS Administrator Backend. The flaw allows injection of malicious scripts that execute in the context of an administrative user's browser session. Attack requires: (1) network access to the application, (2) valid administrator credentials (PR:H), and (3) interaction by the victim administrator (UI:P). The exploit has been publicly disclosed and proof-of-concept may be available. No vendor patch or response has been issued as of the CVE publication date.

Defensive priority

low

Recommended defensive actions

  • Restrict administrative access to trusted networks and enforce multi-factor authentication for all administrator accounts
  • Implement Content Security Policy (CSP) headers to mitigate impact of XSS vulnerabilities
  • Review and sanitize all user input in the /Tag/edit endpoint, applying context-appropriate encoding for output
  • Monitor for unauthorized access attempts to administrative endpoints
  • Subscribe to vendor security advisories or repository notifications for patch availability
  • Consider temporary WAF rules to detect and block suspicious payloads targeting the /Tag/edit endpoint

Evidence notes

Vulnerability identified through source code analysis of FoxCMS Administrator Backend. Affected file: `/Tag/edit`. Weaknesses classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and CWE-94 (Improper Control of Generation of Code). CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-9608 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-9608

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-9608 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-9608

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.