{"id":"CVE-2026-75526","title":"django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django","summary":"django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. From 5.0.8 until 5.0.9, ContentRenderer.render_placeholder in cms/plugin_rendering.py can pass stored, attacker-controlled values…","severity":"medium","cvss":4.4,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N","cwe":["CWE-79"],"vendor":"django-cms","product":"django-cms","affected":["django-cms >= 5.0.8, < 5.0.9"],"patched":["django-cms 5.0.9"],"published":"2026-08-20","updated":"2026-09-09","sourceUpdated":"2026-09-09T21:19:49.197","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-75526","references":[{"url":"https://github.com/django-cms/django-cms/commit/b56a568844ff3702495945f73a31d0868285bf88","label":"security-advisories@github.com"},{"url":"https://github.com/django-cms/django-cms/pull/8711","label":"security-advisories@github.com"},{"url":"https://github.com/django-cms/django-cms/releases/tag/5.0.9","label":"security-advisories@github.com"},{"url":"https://github.com/django-cms/django-cms/security/advisories/GHSA-hvq6-2r72-p2x7","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-hvq6-2r72-p2x7"},{"url":"https://github.com/django-cms/django-cms"},{"url":"https://pypi.org/project/django-cms"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75526"}],"tags":["nvd","ghsa","pip","osv"],"epss":0.00261,"epssPercentile":0.15874,"aliases":["GHSA-hvq6-2r72-p2x7","PYSEC-2026-3825"],"ecosystem":"pip","ingestedAt":"2026-08-20T18:59:54.003Z","slug":"CVE-2026-75526","body":"## Overview\n\ndjango CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. From 5.0.8 until 5.0.9, ContentRenderer.render_placeholder in cms/plugin_rendering.py can pass stored, attacker-controlled values to ContentRenderer.render_exception when plugin rendering fails in edit mode. Values from get_short_description(), the exception message, the placeholder, or placeholder.source are interpolated into a cms-rendering-exception heading and later returned through mark_safe. Because the heading is not escaped, stored HTML executes in an editor’s browser, and settings.DEBUG does not prevent the custom heading from rendering. The fix uses format_html to escape the message before safe placeholder output is returned. This issue is fixed in versions 5.0.9.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-75526)\n\nAffected packages:\n\n- `django-cms >= 5.0.8, < 5.0.9`\n\nPatched in:\n\n- `django-cms 5.0.9`\n\nSource: https://github.com/advisories/GHSA-hvq6-2r72-p2x7","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":24.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}