CVE-2026-52847

Description

The vulnerability exists due to missing output escaping on unauthenticated web parameters. Within the setup script /admin/install.php, user-controlled request inputs are echoed straight back into the resulting HTML page layout via an unescaped printtestresult() or printf call. Because the code does not pass these parameters through a strict encoding layer like htmlspecialchars(), attackers can force a browser to inject unauthorized HTML syntax—such as fake credential-phishing forms or malicious layout overrides—bypassing standard CSP boundary rules.

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

CVSS v4