CVE-2026-93456 Details
Description
django-page-cms through 2.0.13 exempts five admin mutation views from CSRF protection in pages/admin/views.py, allowing attackers to forge requests that modify page content. Signed-in editors visiting a malicious page can be tricked into storing unescaped content that renders to all visitors, enabling stored cross-site scripting attacks.
A vulnerability in Django Page CMS versions through 2.0.13 allows for Cross-Site Request Forgery (CSRF) attacks that lead to stored Cross-Site Scripting (XSS). Five admin mutation views are exempt from CSRF protection, enabling attackers to forge requests that modify page content. Signed-in editors who visit a malicious page can unintentionally store unescaped content that is rendered to all visitors, creating a stored XSS risk.
Remove the '@csrf_exempt' decorator from the affected admin mutation views. Sanitize content before storing it, and avoid using 'mark_safe()' on user-supplied input.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 18, 2026CISA-ADP
Assessed Sep 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-352 | Cross-Site Request Forgery (CSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| batiste django-page-cms | <= 2.0.13 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 21, 2026 | CVE Modified | CISA-ADP |
| Sep 18, 2026 | New CVE Received | [email protected] |