CVE-2026-116212 Details
Description
Webasyst Framework through 4.4.0 contains a stored cross-site scripting vulnerability in the Photos app that allows authenticated backend users to inject JavaScript via the album url parameter. Attackers with album edit rights can save a url value that breaks out of the unescaped attribute in DialogAlbumSettings.html, executing JavaScript in administrators' backend sessions.
A stored cross-site scripting vulnerability has been identified in the Webasyst Framework Photos app, affecting versions through 4.4.0. This vulnerability allows authenticated backend users with album edit rights to inject JavaScript via the album URL parameter. The injected script is executed in the context of administrators' backend sessions when the album settings dialog is opened.
To address this vulnerability, the album URL output in the DialogAlbumSettings template should be escaped to prevent the injection of unescaped HTML. Additionally, the PhotosAlbumSave controller can be updated to validate the URL parameter, rejecting characters outside of a specified range to prevent metacharacter abuse.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 26, 2026CISA-ADP
Assessed Nov 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/webasyst/webasyst-framework/issues/395 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/webasyst/webasyst-framework | [email protected] | Vendor |
| https://github.com/webasyst/webasyst-framework/blob/cc609e5db23e68d982e15ebf65bf9d25120333af/wa-apps/photos/lib/actions/album/photosAlbumSave.controller.php#L107 | [email protected] | Source CodeVendor |
| https://github.com/webasyst/webasyst-framework/blob/cc609e5db23e68d982e15ebf65bf9d25120333af/wa-apps/photos/templates/actions/dialog/DialogAlbumSettings.html#L36 | [email protected] | Source CodeVendor |
| https://github.com/webasyst/webasyst-framework/issues/395 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/webasyst-framework-through-4.4.0-stored-xss-via-photos-album-url | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Webasyst Framework | <= 4.4.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | CISA-ADP |
| Oct 26, 2026 | New CVE Received | [email protected] |