VulnerabilityDeferred

CVE-2026-71249

299Ko's public contact form (plugin/contact/controllers/ContactController.php, home) sets raw POST field values (name, firstname, email, message) into the page template with no sanitization.

MEDIUM 6.1EPSS 0.15%

Does this matter?

Lower severity and a low EPSS score (0.15%). Track it; it rarely justifies an emergency change on its own.

Description

299Ko's public contact form (plugin/contact/controllers/ContactController.php, home) sets raw POST field values (name, firstname, email, message) into the page template with no sanitization. The template engine's variable output function (common/Template.php, _show_var) echoes values with no htmlspecialchars call, and the sink template (contact.tpl) outputs these values unescaped into an HTML attribute and a textarea.

CVSS 3.1: 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS: 0.15% probability · 4th percentile
CISA KEV: Not listed
Weakness: CWE-79
Source: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

References

https://github.com/search?q=299ko&type=repositories

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.