Stored Cross-Site Scripting in Nukegraphic CMS profile name field

Description

Nukegraphic CMS v3.1.2 fails to sanitize the profile name field on the edit-profile endpoint. The value is stored as-is in the backend database and later rendered without encoding wherever a user's name is displayed across the CMS, allowing an authenticated user to store arbitrary HTML/JavaScript that executes in the browser of anyone who views a page containing that name.

Impact

Because the payload is stored rather than reflected, it executes for every user who loads a page rendering the attacker's profile name — including other authenticated users and administrators. Combined with the low privilege bar for an attacker (any registered account), this allows session hijacking, CMS defacement, and forced actions performed with the privileges of whoever views the affected page.

Proof of concept

1. Authenticate to the CMS as any low-privileged user.
2. Navigate to Edit Profile and open the request that updates the profile name.
3. Set the name parameter to a script payload, for example:

<script>alert(document.domain)</script>

4. Submit the update. The payload is persisted to the database unsanitized.
5. Visit any CMS page that renders the user's name (dashboards, comment threads, admin user lists). The payload executes in the viewer's browser session.

A full write-up and PoC assets are available in the CVE-2026-1953 repository.

Remediation

Encode user-supplied profile fields on output (context-aware HTML encoding) everywhere the name is rendered, and apply input validation on the profile update endpoint. Until a vendor patch is available, a CSP with a restrictive script-src mitigates payload execution as a defense-in-depth measure.

Disclosure timeline

• YYYY-MM-DDReported to Nukegraphic.
• YYYY-MM-DDVendor acknowledged the report.
• YYYY-MM-DDCVE-2026-1953 reserved.
• YYYY-MM-DDFix released by vendor.
• 2026-08-04Advisory published.