Security Advisory - 3 issues effecting the CMS - November 2025

Announcements
1

3 security advisory have been resolved in recent releases.

We recommend everyone using Xibo CMS v4 upgrade to Xibo 4.3.1 or the latest release as soon as possible.

Issue 1 - RCE

A remote code execution vulnerability (RCE) was discovered in the Module Templating functionality inside the CMS Developer menu. This allows an authenticated user to manipulate Twig filters and run specific functions server side as the user the web server runs under, which is normally a limited user account.

Exploitation of the vulnerability is possible on behalf of an authorized user who has the “System → Add/Edit custom modules and templates” feature enabled, which by default is only enabled for the super admin user.

When Xibo CMS is deployed in the recommended configuration, it is containerised and this exploit does not escape the container.

For further details please see the security advisory:

Issue 2 & 3 - XSS

The following vulnerabilities were reported via a 3rd party and have been solved since Xibo CMS 4.2.2:

A big thank you to everyone involved in finding and resolving these vulnerabilities. Responsible disclosure of vulnerabilities is vital and the team at Xibo make all vulnerabilities our top priority. See our security policy for more information.

Thanks,
Dan

4 Likes
2

Thanks for being transparent about these issues.

Just FYI, I’m subscribed to both releases and security alerts on the Github repository but did not receive one for these. I’m already updated to 4.3.1, but the weekly community summary email I received this morning was the way I found out about them.

3

I am not sure why you didn’t receive a notification for Issue 1, sorry about that, I would have expected you to get one through GitHub. I am pleased you caught it on the community summary email instead.