Blesta <= 5.13.1 (confirm_url) Reflected Cross-Site Scripting Vulnerability
• Software Link:
• Affected Versions:
All versions from 3.2.0 to 5.13.1.
• Vulnerability Description:
User input passed through the “confirm_url” GET parameter to the /dialog/confirm and /client_dialog/confirm/ endpoints is not properly sanitized before being used to generate HTML output; specifically, before being used as action attribute of an HTML form. This can be exploited by attackers to perform 2-clicks Reflected Cross-Site Scripting (XSS) attacks.
• Proof of Concept:
An attacker may trick a victim Blesta user into clicking on links like these:
http://[blesta]/dialog/confirm/?confirm_url=javascript:alert('XSS')
http://[blesta]/client_dialog/confirm/?confirm_url=javascript:eval(atob('YWxlcnQoJ1hTUyBvbiAnK2RvY3VtZW50LmRvbWFpbik='))
When the victim user clicks on the malicious link and then they also click on the “Yes” button, the form will be submitted, and the attacker-controlled JavaScript code will be executed on the victim user’s browser.
• Solution:
Apply the vendor patch or upgrade to version 5.13.2 or later.
• Disclosure Timeline:
[19/01/2026] – Vendor notified
[22/01/2026] – CVE identifier requested
[28/01/2026] – Version 5.13.2 released
[31/01/2026] – Version 5.13.3 released to address regressions introduced in 5.13.2
[03/02/2026] – CVE identifier assigned
[04/02/2026] – Public disclosure
• CVE Reference:
The Common Vulnerabilities and Exposures project (cve.org) has assigned the name CVE-2026-25616 to this vulnerability.
• Credits:
Vulnerability discovered by Egidio Romano.