| CVE ID | CVE-2026-59074 |
| Publication date | 13 November 2026 |
| Vendor | Edito |
| Product | Edito CMS |
| Vulnerable versions | All before 5.10.2607 |
| Vulnerability type (CWE) | Improper verification of cryptographic signature (CWE-347) |
| Report source | Report to CERT Polska |
| CVE ID | CVE-2026-59075 |
| Publication date | 13 November 2026 |
| Vendor | Edito |
| Product | Edito CMS |
| Vulnerable versions | All before 5.10.2607 |
| Vulnerability type (CWE) | Improper neutralization of special elements used in an expression language statement ('expression language injection') (CWE-917) |
| Report source | Report to CERT Polska |
| CVE ID | CVE-2026-59076 |
| Publication date | 13 November 2026 |
| Vendor | Edito |
| Product | Edito CMS |
| Vulnerable versions | All before 5.10.2607 |
| Vulnerability type (CWE) | Improper neutralization of input during web page generation ('cross-site scripting') (CWE-79) |
| Report source | Report to CERT Polska |
| CVE ID | CVE-2026-59077 |
| Publication date | 13 November 2026 |
| Vendor | Edito |
| Product | Edito CMS |
| Vulnerable versions | All before 5.10.2607 |
| Vulnerability type (CWE) | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') (CWE-79) |
| Report source | Report to CERT Polska |
| CVE ID | CVE-2026-59078 |
| Publication date | 13 November 2026 |
| Vendor | Edito |
| Product | Edito CMS |
| Vulnerable versions | All before 5.10.2607 |
| Vulnerability type (CWE) | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') (CWE-79) |
| Report source | Report to CERT Polska |
| CVE ID | CVE-2026-59079 |
| Publication date | 13 November 2026 |
| Vendor | Edito |
| Product | Edito CMS |
| Vulnerable versions | All before 5.10.2607 |
| Vulnerability type (CWE) | Unrestricted Upload of File with Dangerous Type (CWE-434) |
| Report source | Report to CERT Polska |
| CVE ID | CVE-2026-59080 |
| Publication date | 13 November 2026 |
| Vendor | Edito |
| Product | Edito CMS |
| Vulnerable versions | All through 5.10.2607 |
| Vulnerability type (CWE) | Use of GET request method with sensitive query strings (CWE-598) |
| Report source | Report to CERT Polska |
| CVE ID | CVE-2026-59081 |
| Publication date | 13 November 2026 |
| Vendor | Edito |
| Product | Edito CMS |
| Vulnerable versions | All before 5.10.2607 |
| Vulnerability type (CWE) | Deserialization of untrusted data (CWE-502) |
| Report source | Report to CERT Polska |
Description
CERT Polska has received a report about vulnerabilities in Edito CMS software and participated in coordination of their disclosure.
The vulnerability CVE-2026-59074: Edito CMS is vulnerable to improper cryptographic signature verification in the JWT refresh logic. An authenticated low-privileged user can submit self-crafted JWT containing an existing user identifier and, due to the lack of signature validation, obtain a valid, fully-signed session token for any account in the system. This allows the attacker to impersonate any user, including administrators.
The vulnerability CVE-2026-59075: Edito CMS is vulnerable to Dynamic LINQ injection. Due to improper input validation, an authenticated attacker can inject conditional expressions into the sort parameter of paginated administrative endpoints. Analyzing the returned result order allows the attacker to extract value of any field character by character, leading to potential exposure of sensitive data.
The vulnerability CVE-2026-59076: Edito CMS is vulnerable to Stored XSS. Due to improper input validation, an authenticated attacker can inject malicious scripts into givenName and surname parameters via the /api/auth/profile endpoint. When an administrator visits the admin changelog logs, the injected script is automatically executed, in his browser.
The vulnerability CVE-2026-59077: Edito CMS is vulnerable to Stored XSS via content parameter in Tiny editor functionality. Authenticated attacker can inject arbitrary HTML and JS into website, which will be rendered/executed when user tries to edit changed entry.
The vulnerability CVE-2026-59078: Edito CMS is vulnerable to Stored XSS in avatar upload functionality. Authenticated attacker can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting an URL leading to a edited avatar.
The vulnerability CVE-2026-59079: Edito CMS restricts the ability to upload files via the UI to specific file types. However, an avatar upload functionality allows an attacker to upload files of any type and extension without restriction.
The vulnerability CVE-2026-59081: Edito CMS deserializes JSON data without further validation. A user (even an administrator) cannot exploit this vulnerability through the application's normal functionality. An attacker who could modify cache entries or inject them could execute code on the server.
These issues were fixed in version 5.10.2607. Hotfixes for older versions (5.8) have also been released.
The vulnerability CVE-2026-59080: Edito CMS sends JWT token via GET requests. This allows a local attacker with access to browser history to obtain valid JWT token and perform action on behalf of the victim. The token is valid for only short period of time; after that time, it expires and can no longer be used.
The vendor assessed the likelihood of exploitation as very low and determined that a fix is not necessary.
Credits
We thank Michał Majchrowicz, Dawid Małecki and Paweł Zdunek from AFINE Team for the responsible vulnerability report.
More about the coordinated vulnerability disclosure process at CERT Polska can be found at https://cert.pl/en/cvd/.