N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-8c2g-f8jm-5cr7

GHSA-8c2g-f8jm-5cr7: ibexa/fieldtype-richtext has an XSS vulnerability via acronym custom tag in Rich Text

Impact

This security advisory resolves an XSS vulnerability in acronym custom tag in Rich Text, in the back office of the DXP. Back office access and varying levels of editing and management permissions are required to exploit this vulnerability. This typically means Editor or Administrator role, or similar. Injected XSS is persistent and may in some cases be reflected in the front office, possibly affecting end users. The fixes ensure XSS is escaped, and any existing injected XSS is rendered harmless.

Patches

See "Patched versions".

Workarounds

None.

References

https://developers.ibexa.co/security-advisories/ibexa-sa-2025-004-xss-and-enumeration-vulnerabilities-in-back-office

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-8c2g-f8jm-5cr7

GHSA-8c2g-f8jm-5cr7:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
ibexa/fieldtype-richtext	composer	>= 5.0.0, < 5.0.3	5.0.3
ibexa/fieldtype-richtext	composer	>= 4.6.0, < 4.6.25	4.6.25

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the way the ibexa/fieldtype-richtext package handles the rendering of custom tags within the CKEditor instance. The security advisory points to an XSS vulnerability in the 'acronym' custom tag, but the patch reveals the issue is more general, affecting both block-level and inline-level custom tags.

The analysis of the patch commit 33590a1f2e29849981acfe125906a558fe9b60c3 shows modifications to two key files:

src/bundle/Resources/public/js/CKEditor/custom-tags/block-custom-tag/custom-tag-editing.js
src/bundle/Resources/public/js/CKEditor/custom-tags/inline-custom-tag/inline-custom-tag-editing.js

In both files, the init methods of the IbexaCustomTagEditing and IbexaInlineCustomTagEditing classes define downcast converters. These converters are responsible for transforming the editor's data model into the HTML that is displayed in the editor. The vulnerable code was located inside these converters.

The root cause of the XSS vulnerability was the unsafe construction of HTML strings using innerHTML. The code iterated over the attributes of a custom tag and concatenated the attribute names and values into an HTML string. Crucially, this user-controllable data was not properly sanitized or escaped.

In IbexaInlineCustomTagEditing, both the attribute name and value were used raw.
In IbexaCustomTagEditing, there was an attempt to escape the attribute value, but it was insufficient, and the attribute name was still used raw.

An attacker could exploit this by creating a piece of content with a specially crafted custom tag, for example, using an attribute name like onmouseover='alert(1)'. When this content is loaded in the rich text editor, the malicious JavaScript would be rendered as part of the editor's view and executed.

The patch addresses this by introducing explicit escaping using escapeHTML for values and escapeHTMLAttribute for attribute names before they are included in the generated HTML. This ensures that any potentially malicious content is rendered as inert text rather than being executed.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-8c2g-f8jm-5cr7: ibexa/fieldtype-richtext has an XSS vulnerability via acronym custom tag in Rich Text

Impact

Patches

Workarounds

References

GHSA-8c2g-f8jm-5cr7:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Technical Details

GHSA-8c2g-f8jm-5cr7: ibexa/fieldtype-richtext has an XSS vulnerability via acronym custom tag in Rich Text

Impact

Patches

Workarounds

References

N/A

N/A

Basic Information

Basic Information

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI