Vulnerability · Published Oct 26, 2026 · Assigned by VulnCheck

CVE-2026-116212Webasyst Framework through 4.4.0 Stored XSS via Photos Album URL

Medium 5.4

In plain English

A medium-severity cross-site scripting in Webasyst Framework from Webasyst. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.2%top 93.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Webasyst Framework through 4.4.0 contains a stored cross-site scripting vulnerability in the Photos app that allows authenticated backend users to inject JavaScript via the album url parameter. Attackers with album edit rights can save a url value that breaks out of the unescaped attribute in DialogAlbumSettings.html, executing JavaScript in administrators' backend sessions.

Affected products (as reported)

Vendor	Product	Versions
Webasyst	Webasyst Framework	0 – through 4.4.0

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References

GitHub Issue #395 issue-tracking
https://github.com/webasyst/webasyst-framework/blob/cc609e5db23e68d982e15ebf65bf9d25120333af/wa-apps/photos/templates/actions/dialog/DialogAlbumSettings.html#L36 technical-description
https://github.com/webasyst/webasyst-framework/blob/cc609e5db23e68d982e15ebf65bf9d25120333af/wa-apps/photos/lib/actions/album/photosAlbumSave.controller.php#L107 technical-description
https://github.com/webasyst/webasyst-framework product
VulnCheck Advisory: Webasyst Framework through 4.4.0 Stored XSS via Photos Album URL third-party-advisory