ExpressionEngine 2.6 Persistent XSS

From: Richard Clifford <>
Subject: ExpressionEngine 2.6 Persistent XSS


I'd like to disclose a vulnerability I found in ExpressionEngine 2.6 and 

The issue is when you submit a new entry through Admin -> Content -> 
Publish and you are using the RTE, if you enter HTML into that editor, 
the next page will execute the HTML, which it shouldn\u2019t. The RTE should 
htmlentities all input data that goes in (when you\u2019re not in the 
\u2018source-view\u2019), thus creating a HTML-Safe preview page.

The payload I used was </title><script>alert(document.domain);</script> 
which got executed on the view_entry.php view (system -> 
expressionengine -> views -> content -> view_entry.php)

The reply that I got from the developers was:

In system/expressionengine/controllers/cp/content_publish.php look at 
line 685:
$r .= ee()->api_channel_fields->apply('replace_tag', array('data' => 

And replace it with this:
$r .= ee()->api_channel_fields->apply('replace_tag', array('data' => 

As you can see at:

Best Regards,
Richard Clifford.

Copyright © 1995-2020 All rights reserved.