SB2026072468 - Multiple vulnerabilities in NukeViet

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026072468

SB2026072468 - Multiple vulnerabilities in NukeViet

Published: July 24, 2026

Security Bulletin ID SB2026072468
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 8
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 25% Low 75%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 8 vulnerabilities.


1) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-55372)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N]


The vulnerability allows a remote attacker to coerce the server into issuing HTTP requests to an attacker-chosen host and poison cached response headers.

The vulnerability exists due to server-side request forgery (SSRF) in server_info_update() and forwarded-header handling when processing a POST request with the __serverInfoUpdate=1 field and spoofed X-Forwarded-Host and X-Forwarded-Proto headers. A remote attacker can send a specially crafted request to coerce the server into issuing HTTP requests to an attacker-chosen host and poison cached response headers.

The issue is reachable before authentication, and the SSRF is blind, HEAD-only, and limited to a fixed request path.


2) Path traversal (CVE-ID: CVE-2026-54065)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to delete arbitrary files within the application root.

The vulnerability exists due to path traversal in modules/comment/admin/edit.php when processing the attach parameter in HTTP POST requests. A remote privileged user can submit a specially crafted attach parameter to delete arbitrary files within the application root.

The issue is triggered when the edited comment is subsequently deleted, and deleting config.php can render the application inoperable.


3) Cross-site scripting (CVE-ID: CVE-2026-54064)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to execute arbitrary JavaScript in the browsers of users who view a crafted news article.

The vulnerability exists due to improper neutralization of input during web page generation in the NukeViet\Core\Request filtering logic in vendor/vinades/nukeviet/Core/Request.php when processing user-supplied news content. A remote user can submit crafted content that bypasses anti-XSS filters to execute arbitrary JavaScript in the browsers of users who view a crafted news article.

User interaction is required to view the affected article, and exploitation requires an account with news posting permission.


4) Cross-site scripting (CVE-ID: CVE-2026-49259)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to execute arbitrary JavaScript in the victim's browser.

The vulnerability exists due to cross-site scripting in the comment reply handler in themes/default/modules/comment/comment.tpl when rendering a comment author's display name inside an inline onclick JavaScript string. A remote user can store a specially crafted JavaScript payload in profile display name fields and post a comment to execute arbitrary JavaScript in the victim's browser.

User interaction is required when a visitor clicks the Reply link on a comment posted by the malicious user.


5) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to execute arbitrary JavaScript in the context of the CMS domain.

The vulnerability exists due to cross-site scripting in vendor/vinades/nukeviet/Files/Upload.php when processing uploaded SVG files that are later rendered inline in an article. A remote user can upload a crafted SVG file containing embedded script to execute arbitrary JavaScript in the context of the CMS domain.

User interaction is required when a victim views an article containing the uploaded SVG.


6) XML External Entity injection (CVE-ID: N/A)

CWE-ID: CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')

CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper restriction of XML external entity reference in vendor/vinades/nukeviet/Files/Upload.php when parsing uploaded SVG files. A remote user can upload a crafted SVG file with an external entity reference to disclose sensitive information.

This issue affects PHP versions earlier than 8.0.


7) Cross-site scripting (CVE-ID: CVE-2026-48118)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote attacker to execute arbitrary script in the victim's browser.

The vulnerability exists due to cross-site scripting in the Comment module status_comment parameter handling and rendering path when processing a crafted URL containing base64-encoded HTML or JavaScript. A remote attacker can send a specially crafted URL to execute arbitrary script in the victim's browser.

User interaction is required to open the crafted URL.


8) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to write files outside the expected extension directory.

The vulnerability exists due to path traversal in the extension package upload and installation flow when processing crafted ZIP entry paths during archive extraction. A remote privileged user can upload a specially crafted ZIP archive to write files outside the expected extension directory.

Only instances with the extension upload and install feature enabled are vulnerable. In certain deployments, this may lead to code execution if the written files are interpreted by the server.


Remediation

Install update from vendor's website.

References