CVE-2025-6050
Description
Mezzanine CMS, in versions prior to 6.1.1, contains a Stored Cross-Site Scripting (XSS) vulnerability in the admin interface. The vulnerability exists in the "displayable_links_js" function, which fails to properly sanitize blog post titles before including them in JSON responses served via "/admin/displayable_links.js". An authenticated admin user can create a blog post with a malicious JavaScript payload in the title field, then trick another admin user into clicking a direct link to the "/admin/displayable_links.js" endpoint, causing the malicious script to execute in their browser.
How to fix
- jupo mezzanine6.1.1 or later
- mezzanine6.1.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| jupo mezzanine | v < 6.1.1 | 6.1.1 |
| mezzaninePyPI | v < 6.1.1 | 6.1.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.