CVE-2025-71177: LavaLite CMS Stored Cross-Site Scripting Vulnerability
Summary
CVE-2025-71177: LavaLite CMS affected by a stored cross-site scripting vulnerability. Affects lavalite/cms versions < 10.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
LavaLite CMS is an open-source content management system built on the Laravel framework, designed to simplify the creation and management of websites. It offers features such as package management, user authentication, and customizable themes. However, versions up to and including 10.1.0 are vulnerable to a stored cross-site scripting (XSS) issue, which can be exploited by authenticated users.
Vulnerability Detail
The vulnerability arises from the package creation and search functionality within LavaLite CMS. Authenticated users can input malicious HTML or JavaScript code into the Name or Description fields of a package. This input is stored and later displayed in search results without proper output encoding. When other users view these search results, the injected scripts execute in their browsers, leading to potential session hijacking, credential theft, and unauthorized actions in the context of the victim.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can restrict access to the package creation and search functionalities to trusted users only, minimizing the risk of exploitation until the package is updated.
Conclusion
The stored cross-site scripting vulnerability in LavaLite CMS versions up to 10.1.0 poses significant risks to users. It is crucial to update to the patched version 10.1.1 or later to mitigate these risks. Additionally, using tools like Vulert can help monitor your application for vulnerabilities effectively.
See every vulnerability recorded for lavalite/cms →
FAQ
A stored cross-site scripting vulnerability allows an attacker to inject malicious scripts into a web application, which are then stored and executed in the browsers of other users who access the affected content.
If you are using LavaLite CMS version 10.1.0 or earlier, your installation is vulnerable to this issue. You can check your version in the composer.lock file.
Exploitation of this vulnerability can lead to session hijacking, credential theft, and unauthorized actions performed in the context of the affected user.
Yes, you can use Vulert, which monitors and alerts you in real-time for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
The CVSS score for this vulnerability is 5.1, indicating a moderate level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for lavalite/cms.
