CVE-2026-10514: CordysCRM Cross-Site Scripting (XSS) Vulnerability – Patch to 1.7.0

Technical summary

The vulnerability resides in the RequestParamTrimConfig.java file within CordysCRM's backend framework, where user-supplied input is insufficiently sanitized before being reflected back to the client. This enables stored or reflected XSS attacks (CWE-79). The attack vector also suggests code execution concerns (CWE-94), though the primary manifestation is script injection. Exploitation requires network access and authentication at the administrator level, combined with successful social engineering to induce a privileged user to visit a crafted URL or interact with injected content.

Business impact

The business risk is limited by the attack prerequisites. An attacker would need valid administrative credentials and the ability to trick a high-privilege user into triggering the vulnerability. Successful exploitation could lead to session hijacking, credential theft, or defacement of the CordysCRM interface visible to that user. For organizations with strict access controls and security awareness training, the practical risk is low. However, if administrative accounts are shared, poorly managed, or if the organization operates in a high-social-engineering environment, the risk profile increases.

Affected systems

CordysCRM versions 1.6.2 and earlier are affected. The vulnerability has been patched in version 1.7.0. Organizations running on-premises or cloud instances of CordysCRM should verify their current version against the 1.7.0 release baseline. Since no vendor product metadata was provided in the source data, confirm your specific deployment and any custom extensions that may also require updates.

Exploitability

While exploit code is publicly disclosed, exploitability is constrained by three factors: (1) network access requirement, (2) administrative authentication requirement, and (3) user interaction requirement. These factors collectively result in a CVSS score of 2.4 (LOW severity). An attacker cannot exploit this remotely without valid credentials and cannot achieve exploitation without victim action. The public disclosure of proof-of-concept code does increase the likelihood of opportunistic attacks against organizations with poor credential hygiene, but does not materially change the technical barriers to exploitation.

Remediation

Upgrade CordysCRM to version 1.7.0 or later. The patch is identified by commit hash c87682afa8df79853299f75489c9d333f7bc5fce. Before upgrading, review release notes and test in a non-production environment to ensure compatibility with any customizations or integrations. Implement defense-in-depth measures: enforce strong password policies for administrative accounts, limit administrative access to trusted networks or VPN, enable multi-factor authentication, and conduct security awareness training on phishing and social engineering.

Patch guidance

Obtain version 1.7.0 through the official CordysCRM release channel. Verify the patch commit hash (c87682afa8df79853299f75489c9d333f7bc5fce) in your downloaded package. Test thoroughly in a staging environment before production deployment. If you cannot upgrade immediately, consider temporary mitigations: restrict administrative user access to specific IP ranges, disable unused administrative accounts, and monitor access logs for suspicious activity from admin-level sessions.

Detection guidance

Search access logs for anomalous requests to the RequestParamTrimConfig or related parameter-handling endpoints, particularly from administrative users. Monitor for JavaScript payloads in request parameters or unusual characters (e.g., script tags, event handlers) in form submissions. Use web application firewalls (WAF) to block requests containing common XSS patterns. Inspect DOM-based content changes or unexpected redirects in browser sessions following administrative logins. Log analysis should focus on requests that include encoded or obfuscated script content targeting the affected framework component.

Why prioritize this

Despite public exploit availability, this vulnerability merits moderate-to-low priority due to its strict exploitation prerequisites. Prioritize patching if: (1) your organization has high-risk user communities (high-volume phishing targets, geopolitical significance), (2) administrative credentials are known to be compromised or at elevated risk, or (3) you operate in a defense or critical infrastructure sector where supply-chain attacks are a concern. Standard commercial environments should schedule patching during normal maintenance windows but need not treat this as critical or emergency.

Risk score, explained

The CVSS 3.1 score of 2.4 reflects low severity because the attack requires: (A) network access only, but (B) HIGH privilege level (Admin authentication), (C) user interaction (victim must perform action), and (D) impact is limited to integrity (script injection visible to the user, not confidentiality breach or system availability). The score would be significantly higher if exploitation were unauthenticated or didn't require user interaction. The public exploit disclosure does not elevate the intrinsic CVSS score but does increase the likelihood of exploitation attempts.

Frequently asked questions