PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-10153 westboy CVE debrief

A cross-site scripting (XSS) vulnerability exists in westboy CicadasCMS, affecting the Search function in org/springframework/cache/support/AbstractCacheManager.java. The flaw allows remote attackers to inject malicious scripts via the 's' argument. The vulnerability has a LOW severity CVSS score of 2.1 and has been publicly disclosed with exploit availability noted. The project uses a rolling release model without specific version identifiers for affected or patched releases. The vendor was notified through a Gitee issue report but had not responded as of the CVE publication date of May 30, 2026.

Vendor
westboy
Product
CicadasCMS
CVSS
LOW 2.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-30
Original CVE updated
2026-07-22
Advisory published
2026-05-30
Advisory updated
2026-07-22

Who should care

Organizations running westboy CicadasCMS instances, particularly those exposing search functionality to untrusted users. Security teams monitoring for XSS exposure in Java-based content management systems. Developers maintaining forked or customized versions of CicadasCMS.

Technical summary

The vulnerability exists in the Search function within org/springframework/cache/support/AbstractCacheManager.java of westboy CicadasCMS. The 's' parameter is insufficiently sanitized, allowing injection of executable scripts. Remote exploitation is possible with user interaction required. The CVSS 4.0 vector is AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P. The product follows continuous delivery without discrete version numbering, complicating patch tracking.

Defensive priority

low

Recommended defensive actions

  • Review and sanitize all user-supplied input to the Search function, particularly the 's' parameter, implementing proper output encoding before rendering in HTML contexts
  • Deploy Content Security Policy (CSP) headers to mitigate impact of any XSS vulnerabilities in the application
  • Monitor the Gitee issue tracker for vendor response or patch availability
  • Consider implementing additional input validation layers such as allowlists for expected search term patterns
  • Review application logs for anomalous search requests containing script tags or encoded JavaScript payloads

Evidence notes

The vulnerability was reported through a Gitee issue (IJKWOH) and documented by VulDB. The CNA-assigned CVSS 4.0 vector indicates network attack vector with low attack complexity, no privileges required, and user interaction required. The vulnerability is classified under CWE-79 (Cross-site Scripting) and CWE-94 (Code Injection). The NVD status is 'Received' as of publication. Vendor identification is marked low confidence with Gitee as the reference domain candidate.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-10153 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-10153

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-10153 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-10153

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.