CVE-2026-42558

CVE-2026-42558 describes a vulnerability discovered in Xibo CMS, an open-source digital signage platform. The flaw originated as a Stored Cross-Site Scripting (XSS) vulnerability. This XSS was possible due to insufficient validation when a script was written to disk and a lack of escaping when the script was rendered in the browser. Although the initial XSS was contained within a sandboxed iframe, a researcher successfully escalated this into a full sandbox escape, creating an attack chain. The discovery involved extensive code review to understand the application's input and rendering processes.