CVE-2026-38450: stored XSS in project names and descriptions
| CVE | CVE-2026-38450 |
|---|---|
| Product | Aetopia DAMS |
| Problem type | CWE-79: stored cross-site scripting (XSS) |
| Affected versions | All versions earlier than 9.2.02 |
| Fixed in | 9.2.02 |
What happened
In versions earlier than 9.2.02, text entered as a project’s name or description could be evaluated as a template in the browser of anyone viewing that project, instead of being shown as plain text. A user with permission to edit projects could use this to run script in other users’ browsers.
What we changed in 9.2.02
- Project names and descriptions are displayed only as plain text and are never evaluated as templates.
- The server rejects project names and descriptions that contain template or script syntax.
- A Content Security Policy restricts what scripts can run in the browser.
What you should do
Upgrade to Aetopia DAMS 9.2.02 or later. If you’re not sure which version you’re running, contact us.
Why the published record overstates the risk
The CVE record published on 14 July 2026 lists the weakness as CWE-94 (code injection) and carries a CVSS 3.1 score of 9.8 (Critical). Our assessment is CWE-79 (stored cross-site scripting). The published record overstates the risk:
- It describes the flaw as remote code execution, and the write-up it references calls it server-side template injection through Twig, a PHP template engine. DAMS doesn’t use Twig or PHP.
- The text was evaluated in the user’s browser, not on the server, so it never gave access to the server.
- It needed a logged-in user with permission to edit projects. The 9.8 score assumes no login is required.
References
- CVE-2026-38450 on cve.org
- CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
Revision history
- 21 October 2026: first published.
Questions about this advisory?
If you want to check which version you’re running or talk through this advisory, get in touch and we’ll get back to you within one business day.