[KIS-2026-01] Blesta <= 5.13.1 (confirm_url) Reflected Cross-Site Scripting Vulnerability

[Egidio Romano <n0b0d13s () gmail com>]

---------------------------------------------------------------------------
Blesta <= 5.13.1 (confirm_url) Reflected Cross-Site Scripting Vulnerability
---------------------------------------------------------------------------


[-] Software Link:

https://www.blesta.com


[-] Affected Versions:

All versions from 3.2.0 to 5.13.1.


[-] Vulnerability Description:

User input passed through the "confirm_url" GET parameter to the
/dialog/confirm and /client_dialog/confirm/ endpoints is not properly
sanitized before being used to generate HTML output; specifically,
before being used as action attribute of an HTML form. This can be
exploited by attackers to perform 2-clicks Reflected Cross-Site
Scripting (XSS) attacks.


[-] Proof of Concept:

An attacker may trick a victim Blesta user into clicking on links like these:

http://[blesta]/dialog/confirm/?confirm_url=javascript:alert('XSS')
http://[blesta]/client_dialog/confirm/?confirm_url=javascript:eval(atob('YWxlcnQoJ1hTUyBvbiAnK2RvY3VtZW50LmRvbWFpbik='))

When the victim user clicks on the malicious link and then they also
click on the "Yes" button, the form will be submitted, and the
attacker-controlled JavaScript code will be executed on the victim
user's browser.


[-] Solution:

Apply the vendor patch or upgrade to version 5.13.2 or later.


[-] Disclosure Timeline:

[19/01/2026] - Vendor notified

[22/01/2026] - CVE identifier requested

[28/01/2026] - Version 5.13.2 released

[31/01/2026] - Version 5.13.3 released to address regressions
introduced in 5.13.2

[03/02/2026] - CVE identifier assigned

[04/02/2026] - Public disclosure


[-] CVE Reference:

The Common Vulnerabilities and Exposures project (cve.org) has
assigned the name CVE-2026-25616 to this vulnerability.


[-] Credits:

Vulnerability discovered by Egidio Romano.


[-] Other References:

https://www.blesta.com/2026/01/28/security-advisory/


[-] Original Advisory:

https://karmainsecurity.com/KIS-2026-01
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/