CVE-2026-32278: Connect CMS has Stored Cross-site Scripting (XSS) in the File Field of its Form Plugin
(updated )
A Stored Cross-site Scripting (XSS) issue exists in the file field of the Form Plugin.
References
- github.com/advisories/GHSA-mv3p-7p89-wq9p
- github.com/opensource-workshop/connect-cms
- github.com/opensource-workshop/connect-cms/commit/9d87fe8ecf7f57efbb0e5231be058807734c96b3
- github.com/opensource-workshop/connect-cms/releases/tag/v1.41.1
- github.com/opensource-workshop/connect-cms/releases/tag/v2.41.1
- github.com/opensource-workshop/connect-cms/security/advisories/GHSA-mv3p-7p89-wq9p
- nvd.nist.gov/vuln/detail/CVE-2026-32278
Code Behaviors & Features
Detect and mitigate CVE-2026-32278 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →