Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a stored Cross-Site Scripting (XSS) issue in the Request class of NukeViet CMS. The root cause is insufficient server-side sanitization of user-provided HTML content. The application failed to properly sanitize attributes that can contain HTML content, specifically the srcdoc attribute of an <iframe> tag. An attacker could submit a crafted payload like <iframe srcdoc="<img src=1 onerror=alert(1)>"></iframe>. The server would store this payload without properly sanitizing the content of the srcdoc attribute.
The analysis of the patch commit 2a0860fbe22e2f6a3b90f802bf80b25e18699611 reveals that the changes were made in the vendor/vinades/nukeviet/Core/Request.php file. The core of the vulnerability lies within the Request::filterAttr private method. This function is responsible for filtering attributes within HTML tags. Before the patch, it lacked the logic to handle attributes that can contain a full HTML document, like srcdoc. The patch introduces a recursive filtering mechanism by checking for such attributes (defined in the new $htmlContentAttributes property) and then calling $this->filterTags() on their content.
Therefore, Request::filterAttr is the primary vulnerable function because it contains the flawed logic. The Request::filterTags function is also identified as a vulnerable function because it is the orchestrator of the HTML filtering process and is the function that calls the flawed filterAttr method. Any user input processed by filterTags would trigger the vulnerable code path. During an exploit, both Request::filterTags and Request::filterAttr would appear in a runtime profile or stack trace.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| nukeviet/nukeviet | composer | <= 4.4.01 |
