CVE-2026-29934 Details

A reflected cross-site scripting vulnerability has been identified in LightCMS version 2.0, specifically within the /admin/menus component. This vulnerability allows attackers to execute arbitrary JavaScript in the context of the user's browser by modifying the referer value in the request header. The issue can be triggered without requiring user login.

Users are advised to implement input validation to verify the length, type, syntax, and business rules of all input data before acceptance. Output encoding should be applied to ensure that user-submitted data is correctly encoded as an entity prior to output. It is important to specify the encoding method for output and to be cautious of the limitations of blacklist verification methods, as these can be easily bypassed. Additionally, normalization errors should be addressed by decoding and normalizing input before validation, ensuring that special characters are properly filtered or converted to their entity forms.