NukeViet (< 4.6.00) - CraftedSignal Threat Feed

NukeViet Multiple Anti-XSS Filter Bypasses Leading to Stored XSS

hello@craftedsignal.io — Mon, 13 Jul 2026 17:58:46 +0000

A critical vulnerability, CVE-2026-54064, has been identified in NukeViet content management system versions prior to 4.6.00, specifically impacting the NukeViet\Core\Request class. This vulnerability allows a low-privileged authenticated user with news-posting permissions to execute stored Cross-Site Scripting (XSS) attacks. Two distinct filter bypass techniques enable attackers to inject arbitrary JavaScript: one involves prefixing HTML event handler attributes with a Form Feed character (\x0C) to circumvent filterAttr()'s on keyword check, and the other utilizes a decimal HTML entity ( ) for a tab character within javascript: URIs to bypass unhtmlentities()'s keyword filtering. These bypasses allow malicious scripts to be embedded in news articles, which are then rendered and executed in the browsers of any visitor, including administrators. This can lead to severe consequences such as session hijacking, credential theft, website defacement, and potential full system compromise, underscoring the importance of immediate patching.

Attack Chain

An attacker obtains low-privileged user credentials for a NukeViet instance, with permissions to post or edit news articles.
The attacker crafts a malicious payload, such as , intending to inject it into a news article's content.
Alternatively, the attacker crafts a Markdown-style link containing jav ascript:alert('XSS'), which is designed to bypass NukeViet's input sanitization.
The attacker submits the crafted payload as part of the bodyhtml field when creating or updating a news article within the NukeViet CMS.
NukeViet's backend processing, specifically NukeViet\Core\Request::filterAttr() and NukeViet\Core\Request::unhtmlentities(), fails to correctly sanitize the input due to the identified filter bypasses.
The unsanitized malicious HTML and JavaScript are persistently stored in the NukeViet database.
When any user, including an administrator, browses to the affected news article page, their web browser renders the malicious content.
The embedded JavaScript executes within the victim's browser context, potentially leading to session cookie theft, credential harvesting, or other malicious actions, ultimately resulting in privilege escalation or further compromise.

Impact

The successful exploitation of this vulnerability grants an authenticated attacker with news-posting permissions the ability to inject persistent JavaScript into the NukeViet content management system. This JavaScript executes within the browser of any user who views the compromised news article, including highly privileged administrators. The primary consequences include session cookie theft, which can lead to account takeover, and credential harvesting through deceptive forms. Furthermore, attackers could deface the website, redirect users to malicious sites, or leverage the compromised administrator session to achieve further privilege escalation and potentially full control over the NukeViet installation and underlying server. This widespread impact on all visitors, coupled with the potential for administrative account compromise, poses a significant threat to data integrity and system security.

Recommendation

Apply the patch by updating NukeViet to version 4.6.00 or higher immediately to address CVE-2026-54064.
Implement robust web application firewall (WAF) rules to detect and block requests containing known XSS bypass techniques, such as the Form Feed character (%0C) within HTML attribute names or decimal HTML entities ( ) in javascript: URIs, specifically referencing the patterns found in CVE-2026-54064.
Enable comprehensive logging of HTTP request bodies for web servers hosting NukeViet instances, where feasible, to capture full payload data for detection and forensic analysis of XSS attempts related to CVE-2026-54064.

NukeViet: Path Traversal to Arbitrary File Deletion in Edit Comment Function

hello@craftedsignal.io — Mon, 13 Jul 2026 17:57:37 +0000

A high-severity path traversal vulnerability, tracked as CVE-2026-54065, affects NukeViet versions prior to 4.6.00. This flaw resides within the Edit Comment administrative function and can be exploited by an authenticated administrator. Attackers can leverage an unvalidated attach parameter in an HTTP POST request to inject path traversal sequences (e.g., ../../) into the database. When a comment containing this malicious attach value is subsequently deleted, the nv_deletefile() function, which uses realpath() but lacks sufficient directory restriction, is tricked into deleting arbitrary files within the NV_ROOTDIR, such as config.php. This can lead to a complete application outage and exposure of the installation wizard, severely impacting the availability and integrity of the affected NukeViet instance.

Attack Chain

An attacker gains or has access to administrator credentials for a NukeViet instance.
The attacker logs into the NukeViet admin panel and navigates to the "Comment Management" section.
The attacker intercepts the HTTP POST request made when editing an existing comment.
The attacker crafts the attach parameter in the POST request by prepending 26 arbitrary characters (e.g., aaaaaaaaaaaaaaaaaaaaaaaaaa) followed by a path traversal sequence leading to a critical file, such as ../../config.php.
The vulnerable substr() function processes this crafted attach parameter, effectively storing ../../config.php into the database due to incorrect length calculation and lack of validation.
The attacker then deletes the modified comment from the NukeViet admin panel.
During the comment deletion process, del.php retrieves the malicious attach value from the database and passes it to nv_deletefile().
nv_deletefile() resolves the path to the target file (e.g., config.php) using realpath() and proceeds to delete it from the application root, bypassing directory restrictions.
The NukeViet application becomes inoperable due to the deletion of critical files like config.php, immediately redirecting to the install wizard.

Impact

Successful exploitation of CVE-2026-54065 allows an authenticated administrator to permanently delete any file readable by the web server process within the NukeViet installation root directory (NV_ROOTDIR). The most significant impact is the deletion of config.php, which renders the NukeViet application entirely inoperable and automatically redirects users to the installation wizard, signifying a complete loss of application availability. This vulnerability has a CVSS v3.1 score of 8.7 (High), indicating high impact on integrity and availability with high privileges required but low attack complexity.

Recommendation

Patch CVE-2026-54065 immediately by upgrading NukeViet to version 4.6.00 or later to ensure the nv_is_file() validation is applied to the attach parameter.
Implement web application firewall (WAF) rules to detect and block HTTP POST requests to modules/comment/admin/edit.php containing path traversal sequences (e.g., ../, ..%2f) within the attach parameter.
Monitor web server logs for HTTP POST requests to modules/comment/admin/edit.php that contain unusual or path-like values in the attach parameter, particularly those with repeated directory traversal sequences, using the Sigma rule provided in this brief.