CVE-2026-2897: funadmin XSS Vulnerability in Backend Interface Component
Summary
CVE-2026-2897: funadmin: XSS through Value argument in Backend Interface component. Affects funadmin/funadmin versions < 7.1.0-rc4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
funadmin is an open-source web application framework designed for managing backend functionalities in web applications. It provides a user-friendly interface for administrators to manage content, users, and settings. However, versions up to 7.1.0-rc4 have been found to contain a critical vulnerability that exposes the application to cross-site scripting (XSS) attacks, which can compromise user data and application integrity.
Vulnerability Detail
A security vulnerability has been identified in funadmin, specifically in the Backend Interface component. The issue arises from improper handling of the 'Value' argument in the file app/backend/view/index/index.html. This flaw allows attackers to inject malicious scripts into web pages viewed by other users, leading to potential data theft, session hijacking, or other malicious activities. The vulnerability can be exploited remotely, making it particularly dangerous.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can sanitize the input for the 'Value' argument in the affected file to prevent script injection. This can be done by implementing input validation and escaping output in the application code. For example, you can use PHP's htmlspecialchars function to encode special characters:
$value = htmlspecialchars($_GET['Value'], ENT_QUOTES, 'UTF-8');
Conclusion
The funadmin package has a critical XSS vulnerability (CVE-2026-2897) that affects versions up to 7.1.0-rc4. Users are advised to update to a patched version to secure their applications. Implementing workarounds can provide temporary relief, but updating is the best long-term solution.
See every vulnerability recorded for funadmin/funadmin →
FAQ
CVE-2026-2897 is a vulnerability in the funadmin package that allows for cross-site scripting (XSS) attacks through the Backend Interface component.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors vulnerabilities using your composer.lock file.
Exploitation of this vulnerability can lead to unauthorized access to user data, session hijacking, and other malicious activities that compromise application security.
Yes, a patch is available. Users should update to a version of funadmin later than 7.1.0-rc4 to mitigate the vulnerability.
If an immediate update is not possible, implement input validation and output escaping as a temporary workaround to mitigate the risk of XSS attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for funadmin/funadmin.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
