PatchSiren cyber security CVE debrief
CVE-2026-9608 QianFox CVE debrief
A stored cross-site scripting (XSS) vulnerability exists in QianFox FoxCMS versions up to and including 1.2.6. The affected endpoint is `/Tag/edit` within the Administrator Backend component. Successful exploitation requires high privileges (administrator access) and user interaction, limiting the attack surface to authenticated administrative sessions. The vulnerability has been publicly disclosed via a GitHub issue report, and the vendor has not responded to date. The CVSS 4.0 score of 1.9 reflects the restricted attack vector requiring privileged access and user interaction, with limited integrity impact.
- Vendor
- QianFox
- Product
- FoxCMS
- CVSS
- LOW 1.9
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-27
- Original CVE updated
- 2026-05-27
- Advisory published
- 2026-05-27
- Advisory updated
- 2026-05-27
Who should care
Organizations running FoxCMS ≤1.2.6 with exposed administrative interfaces; security teams managing CMS deployments; developers maintaining FoxCMS instances.
Technical summary
The vulnerability exists in an unknown function within `/Tag/edit` of the FoxCMS Administrator Backend. The flaw allows injection of malicious scripts that execute in the context of an administrative user's browser session. Attack requires: (1) network access to the application, (2) valid administrator credentials (PR:H), and (3) interaction by the victim administrator (UI:P). The exploit has been publicly disclosed and proof-of-concept may be available. No vendor patch or response has been issued as of the CVE publication date.
Defensive priority
low
Recommended defensive actions
- Restrict administrative access to trusted networks and enforce multi-factor authentication for all administrator accounts
- Implement Content Security Policy (CSP) headers to mitigate impact of XSS vulnerabilities
- Review and sanitize all user input in the /Tag/edit endpoint, applying context-appropriate encoding for output
- Monitor for unauthorized access attempts to administrative endpoints
- Subscribe to vendor security advisories or repository notifications for patch availability
- Consider temporary WAF rules to detect and block suspicious payloads targeting the /Tag/edit endpoint
Evidence notes
Vulnerability identified through source code analysis of FoxCMS Administrator Backend. Affected file: `/Tag/edit`. Weaknesses classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and CWE-94 (Improper Control of Generation of Code). CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P.
Official resources
Public disclosure occurred 2026-05-27 via VulDB and GitHub issue report. Vendor was notified through GitHub issue #2 prior to publication with no response received.