FormCms v0.5.5 contains a stored cross-site scripting (XSS) vulnerability in the avatar upload feature. Authenticated users can upload .html files containing malicious JavaScript, which are accessibl…

Medium CVSS 6.1

CVECVE-2025-56236

First seen2026-09-26 00:31 UTC

Disclosed2025-08-28 15:16 UTC

Last updated2026-09-26 00:31 UTC

Channel statusauto

Summary

FormCms v0.5.5 contains a stored cross-site scripting (XSS) vulnerability in the avatar upload feature. Authenticated users can upload .html files containing malicious JavaScript, which are accessible via a public URL. When a privileged user accesses the file, the script executes in their browser context.

In-depth triage

No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).

Affected products

Sources

NVD DATABASE

Original Links

https://github.com/FormCms/FormCms/issues/27 Exploit
https://github.com/KKC73/me/blob/main/CVE-2025-56236/README.md Third Party Advisory

Timeline

2026-09-26 nvd_ingest NVD