l4v4d0/cve-2026-29519-lucee-reflected-xssProof of Concept for Reflected XSS in Lucee CFML (CVE-2026-29519)
Proof of Concept for Reflected XSS in Lucee CFML (CVE-2026-29519)
A critical 0-day Reflected Cross-Site Scripting (XSS) vulnerability has been discovered in Lucee CFML's URL path parsing mechanism. This vulnerability allows attackers to inject and execute arbitrary HTML/JavaScript in the context of the Lucee application, including the administrative interface. The vulnerability affects 22 different Lucee versions spanning from 5.3.1.95 through the latest 7.x release.
22 versions from 5.3.1.95 through , including all 7.x snapshots.
| Version | Status | Notes |
|---|---|---|
| 7.0.0.395 | ✅ VULNERABLE | Latest 7.x release |
| 6.2.3.35 | ✅ VULNERABLE | Latest 6.2.x patch |
| 6.2.2.91 | ✅ VULNERABLE | |
| 6.2.1.122 | ✅ VULNERABLE | |
| 6.2.0.321 | ✅ VULNERABLE | Original discovery version |
| 6.1.2.47 | ✅ VULNERABLE | |
| 6.1.1.118 | ✅ VULNERABLE | |
| 6.1.0.243 | ✅ VULNERABLE | |
| 5.3.7.59 | ✅ VULNERABLE | |
| 5.3.7.47 | ✅ VULNERABLE | |
| 5.3.7.43 | ✅ VULNERABLE | |
| 5.3.6.68 | ✅ VULNERABLE | |
| 5.3.6.61 | ✅ VULNERABLE | |
| 5.3.5.96 | ✅ VULNERABLE | |
| 5.3.5.92 | ✅ VULNERABLE | |
| 5.3.4.80 | ✅ VULNERABLE | |
| 5.3.4.77 | ✅ VULNERABLE | Shows debug info in homepage |
| 5.3.3.67-SNAPSHOT | ✅ VULNERABLE | |
| 5.3.3.62 | ✅ VULNERABLE | |
| 5.3.2.77 | ✅ VULNERABLE | |
| 5.3.1.102 | ✅ VULNERABLE | |
| 5.3.1.95 | ✅ VULNERABLE |
# 1. Start a vulnerable Lucee instance (example: 6.2.0.321 or Latest 7.x)
docker run -d -p 8888:8888 --name lucee-test lucee/lucee:6.2.0.321
# 2. Wait 35-40 seconds for initialization
sleep 40
# 3. Test the vulnerability by visiting:
http://[lucee-host]/test//index.cfm/
# 4. Observe JavaScript execution (alert dialog appears).
# 5. Clean up
docker stop lucee-test 2>/dev/null; docker rm lucee-test 2>/dev/null
No official patch has been released by Lucee, as the vendor did not respond to this report. However, the following versions are not vulnerable:
Secure Versions (Not Vulnerable)
Companies can upgrade/downgrade to these versions to avoid the XSS:
6.0.x Branch (Secure)
5.4.x Branch (Secure)
5.3.x Branch (Some Secure)
Environment
Testing Duration: 18+ hours manual testing
Versions Tested: 50+ Lucee releases (4.5.1.024 through 7.0.0.395)
Platform: Docker containers on Ubuntu Linux
Tools: curl, manual browser testing, Burp Suite
1- Upgrade to the latest secure version:
2- If upgrading is not possible, apply a temporary WAF rule to block HTML tags in URL paths. Example (nginx):
location ~* "<.*>" { return 403; }
3- Monitor Lucee's official channels for a future security patch. Since the vendor has been unresponsive, companies should also consider reaching out directly to Lucee for a fix.
| Metric | Value | Explanation |
|---|---|---|
| Attack Vector | Network | Exploitable remotely over network |
| Attack Complexity | Low | No special conditions required |
| Privileges Required | None | No authentication needed |
| User Interaction | Required | Victim must click malicious link |
| Scope | changed | The vulnerability resides in the server but impacts the user's browser session, crossing a security boundary. |
| Confidentiality | High | Can steal credentials, session data |
| Integrity | Low | Can modify page content, perform CSRF |
| Availability | None | No direct availability impact |
CVSS Score: 7.4 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N)
[email protected] and private GitHub Security Advisory (GHSA-6x3c-35h8-3h9f) created. No response.