CVE-2026-59078

UNKNOWN 0.0

Stored XSS in Edito CMS

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Edito CMS is vulnerable to Stored XSS in avatar upload functionality. Authenticated attacker can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting an URL leading to a edited avatar. This issue was fixed in version 5.10.2607. Hotfixes for older versions (5.8) have also been released.

CWE	CWE-79
Vendor	edito
Product	edito cms
Published	Nov 13, 2026

Stay Ahead of the Next One

Get instant alerts for edito edito cms

Be the first to know when new unknown vulnerabilities affecting edito edito cms are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Edito / Edito CMS

0 < 5.10.2607

References

NVD ↗ CVE.org ↗ EPSS Data ↗

cert.pl: https://cert.pl/posts/2026/11/CVE-2026-59074 edito.pl: https://www.edito.pl/

Credits

Michał Majchrowicz (AFINE Team) Dawid Małecki (AFINE Team) Paweł Zdunek (AFINE Team)