CVE-2025-41089: Reflected XSS in Xibo CMS

I have discovered a Reflected Cross-Site Scripting (XSS) vulnerability in Xibo CMS v4.1.2. This issue stems from the application's failure to properly sanitize user-supplied input in the 'Configuration Name' field of certain widgets within the template editor.

An attacker can craft a special link or trigger an action that injects a malicious script into this field. When a user interacts with the affected page, the script is reflected from the server and executed in the victim's browser.

---

Proof of Concept (PoC)

To trigger the vulnerability, an authenticated user must follow these steps:

1. Navigate to the Design > Templates section and create a new template.
2. Add a widget that contains a 'Configuration Name' field, such as the 'Clock' widget.
3. In the 'Configuration Name' field (located on the left-hand panel), insert a malicious XSS payload (e.g., <script>alert(1337)</script>).
4. When the form is submitted or the page reloads with this data in the URL or POST body, the server will reflect the payload back to the browser, causing the script to execute.

---

Exploitation and Impact

Unlike Stored XSS, a Reflected XSS payload is not stored in the database. The following picture shows the compromied component: