CVE-2026-71249 Details

A reflected cross-site scripting vulnerability has been identified in the public contact form of 299Ko CMS. The issue arises in the ContactController.php file, where raw POST data including name, firstname, email, and message are inserted into the page template without proper sanitization. The template engine's variable output function, located in common/Template.php, fails to escape these values, allowing them to be output unescaped into an HTML attribute and a textarea. This vulnerability enables an unauthenticated attacker to inject a script payload, such as a JavaScript alert, which could be executed by any visitor who submits or is manipulated into auto-submitting the form, potentially targeting an administrator and leading to session token theft.