Vulnerability DatabaseCVE-2026-32278
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2026-32278
March 23, 2026
Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the 2.x series up to and including 2.41.0, a Stored Cross-site Scripting (XSS) issue exists in the file field of the Form Plugin. Versions 1.41.1 and 2.41.1 contain a patch.
Affected Packages
https://github.com/opensource-workshop/connect-cms.git (GITHUB):
Affected version(s) >=v2.0.0 <v2.41.1
Fix Suggestion:
Update to version v2.41.1
https://github.com/opensource-workshop/connect-cms.git (GITHUB):
Affected version(s) >=v2.0.0 <v2.41.1
Fix Suggestion:
Update to version v2.41.1
https://github.com/opensource-workshop/connect-cms.git (GITHUB):
Affected version(s) >=v0.0.1.20200106 <v1.41.1
Fix Suggestion:
Update to version v1.41.1
opensource-workshop/connect-cms (PHP):
Affected version(s) >=v1.0.0 <v1.41.1
Fix Suggestion:
Update to version v1.41.1
opensource-workshop/connect-cms (PHP):
Affected version(s) >=v1.0.0 <v1.41.1
Fix Suggestion:
Update to version v1.41.1
opensource-workshop/connect-cms (PHP):
Affected version(s) >=v2.0.0 <v2.41.1
Fix Suggestion:
Update to version v2.41.1
opensource-workshop/connect-cms (PHP):
Affected version(s) >=v1.0.0 <v1.41.1
Fix Suggestion:
Update to version v1.41.1
opensource-workshop/connect-cms (PHP):
Affected version(s) >=v2.0.0 <v2.41.1
Fix Suggestion:
Update to version v2.41.1
opensource-workshop/connect-cms (PHP):
Affected version(s) >=v2.0.0 <v2.41.1
Fix Suggestion:
Update to version v2.41.1
opensource-workshop/connect-cms (PHP):
Affected version(s) >=v1.0.0 <v1.41.1
Fix Suggestion:
Update to version v1.41.1
Related Resources (6)
https://github.com/opensource-workshop/connect-cms/releases/tag/v1.41.1
https://github.com/opensource-workshop/connect-cms
https://github.com/opensource-workshop/connect-cms/releases/tag/v2.41.1
https://github.com/opensource-workshop/connect-cms/commit/9d87fe8ecf7f57efbb0e5231be058807734c96b3
https://github.com/opensource-workshop/connect-cms/security/advisories/GHSA-mv3p-7p89-wq9p
https://nvd.nist.gov/vuln/detail/CVE-2026-32278
Do you need more information?
Contact Us
CVSS v4
Base Score:
8.9
Attack Vector
NETWORK
Attack Complexity
HIGH
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
PASSIVE
Vulnerable System Confidentiality
HIGH
Vulnerable System Integrity
HIGH
Vulnerable System Availability
LOW
Subsequent System Confidentiality
HIGH
Subsequent System Integrity
HIGH
Subsequent System Availability
LOW
CVSS v3
Base Score:
8.2
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
LOW
Weakness Type (CWE)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79
Unrestricted Upload of File with Dangerous Type
CWE-434
EPSS
Base Score:
0.04