CVE-2026-110239
MEDIUMCVSS 4.4Description
Rapyd Admin before 9.20.0 contains a stored cross-site scripting vulnerability in the x-rpd::rich-text Blade component that outputs bound model values as raw HTML without sanitisation. Authenticated users can set the bound property through the Livewire client API to store JavaScript that executes when administrators open the record's form.
Timeline
Published:October 13th, 2026 7:18 PM
Last modified:October 14th, 2026 4:17 PM
CVSS Scoring
CVSS v3: 4.4 (MEDIUM)
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses (CWE)
References & Reports
Advisories, patches, and third-party reports
- https://github.com/zofe/rapyd-admin
- https://github.com/zofe/rapyd-admin/blob/v9.19.0/resources/views/components/rich-text.blade.php#L50-L61
- https://github.com/zofe/rapyd-admin/blob/v9.19.0/src/helpers.php#L11-L29
- https://github.com/zofe/rapyd-admin/commit/acd6ee85f9e5ccec67199673b039c605d161406a
- https://github.com/zofe/rapyd-admin/releases/tag/v9.20.0
- https://www.vulncheck.com/advisories/rapyd-admin-before-9.20.0-stored-xss-via-rich-text-component
Source: NIST NVD · Data may lag official sources by up to one minute