CVE-2026-30994 Details

A vulnerability allowing sensitive data exposure has been identified in Slah CMS versions through 1.5.0. This issue arises from incorrect access control in the config.php component, where active session credentials are logged in plaintext to a publicly accessible JavaScript file. As a result, unauthenticated attackers can retrieve sensitive information, including session keys, usernames, and passwords, potentially leading to unauthorized account access.

Users are advised to update Slah CMS to the latest patched version. Additionally, the insecure logging mechanism in 'config.php' should be removed, as session credentials must not be written to publicly accessible files.