CVE-2026-79363 Details

A stored cross-site scripting vulnerability has been identified in Cloudron versions 9.1.7 and 9.2. The issue arises in the Branding Footer feature, where an authenticated administrator can inject HTML containing JavaScript event handlers. This injected content is not properly sanitized and is rendered on the public login and OpenID interaction pages, as well as in the System Event Log. As a result, the injected JavaScript executes in the context of the Cloudron web origin when the affected page is accessed.

Users can upgrade to Cloudron version 10.0.0 or later, where this vulnerability has been fixed. Cloudron has publicly stated that the fix involves using DOMPurify for HTML sanitization. For future reference, only allow arbitrary HTML where necessary and ensure it is sanitized with a maintained library before reaching any DOM sink. Event log values should be rendered as text or with context-appropriate output encoding, and a restrictive Content Security Policy should be maintained as an additional layer of defense.