Brave CMS Vulnerability: Phishing via Unescaped Contact Form

The National Vulnerability Database has disclosed CVE-2026-41576, a high-severity vulnerability (CVSS 7.1) in Brave CMS, an open-source content management system. Prior to commit 6c56603, the contact form on Brave CMS installations was publicly accessible without authentication. This flaw allowed unauthenticated users to inject arbitrary HTML into emails sent to administrators.

The vulnerability stems from insufficient sanitization. While user-supplied message text was processed by PHP’s nl2br() function, which converts newlines to <br> tags, it failed to escape other HTML characters. This unsanitized input was then rendered directly in a Blade email template using the unescaped {!! $msg !!} directive. Although modern email clients typically block JavaScript execution, they still render HTML, enabling attackers to craft highly convincing phishing interfaces directly within administrator emails.

The attacker’s calculus here is straightforward: leverage a trusted communication channel (the site’s own contact form) to deliver a malicious payload directly to a high-value target (the administrator). This isn’t about code execution on the server, but about social engineering a recipient through a highly credible vector. Defenders need to understand that this kind of HTML injection creates a powerful illusion of legitimacy, making it far more effective than generic phishing attempts. The issue has been patched in commit 6c56603.