From aae9f50cad16b7ae5096d4958e76624af25030af Mon Sep 17 00:00:00 2001
From: Niels Kaspers <kaspersniels@gmail.com>
Date: Wed, 28 Jan 2026 14:27:05 +0200
Subject: [PATCH] Fix CVE-2025-71177: Stored XSS in title/name fields

Multiple Blade templates were rendering user-controllable data
(title, name fields) using unescaped output {!! !!} which allows
stored XSS attacks.

When users input malicious scripts in name/title fields (e.g.,
<script>alert('xss')</script>), the script executes when the
content is displayed in show/edit views or search results.

Fix: Replace {!! $data['title'] !!} and similar patterns with
{{ $data['title'] }} to ensure HTML entities are properly escaped.

Affected components:
- Master module (show, edit views)
- Menu module (show, edit, nestable views)
- Notification module (show, edit views)
- Role/Permission modules (show, edit views)
- Setting module (edit view)
- Team module (show, edit views)
- User/Client modules (show, edit views)

Fixes: https://github.com/LavaLite/cms/issues/420
CVE: CVE-2025-71177

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---
 src/Litepie/Master/resources/views/master/edit.blade.php      | 2 +-
 src/Litepie/Master/resources/views/master/show.blade.php      | 2 +-
 src/Litepie/Menu/resources/views/admin/edit.blade.php         | 2 +-
 .../Menu/resources/views/admin/menu/nestable.blade.php        | 4 ++--
 .../Menu/resources/views/admin/menu/sub/nestable.blade.php    | 4 ++--
 src/Litepie/Menu/resources/views/admin/show.blade.php         | 2 +-
 .../resources/views/default/notification/edit.blade.php       | 2 +-
 .../resources/views/default/notification/show.blade.php       | 2 +-
 .../Role/resources/views/default/permission/edit.blade.php    | 2 +-
 .../Role/resources/views/default/permission/show.blade.php    | 2 +-
 src/Litepie/Role/resources/views/default/role/edit.blade.php  | 2 +-
 src/Litepie/Role/resources/views/default/role/show.blade.php  | 2 +-
 src/Litepie/Setting/resources/views/edit.blade.php            | 2 +-
 src/Litepie/Team/resources/views/edit.blade.php               | 2 +-
 src/Litepie/Team/resources/views/show.blade.php               | 2 +-
 src/Litepie/User/resources/views/client/edit.blade.php        | 2 +-
 src/Litepie/User/resources/views/client/show.blade.php        | 2 +-
 src/Litepie/User/resources/views/user/edit.blade.php          | 2 +-
 src/Litepie/User/resources/views/user/show.blade.php          | 2 +-
 19 files changed, 21 insertions(+), 21 deletions(-)

diff --git a/src/Litepie/Master/resources/views/master/edit.blade.php b/src/Litepie/Master/resources/views/master/edit.blade.php
index 07550fdd..f8afa9cc 100644
--- a/src/Litepie/Master/resources/views/master/edit.blade.php
+++ b/src/Litepie/Master/resources/views/master/edit.blade.php
@@ -2,7 +2,7 @@
     <div class="app-sec-title app-sec-title-with-icon app-sec-title-with-action">
         <a href="#" class="mobile-back-btn"><i class="las la-arrow-left"></i></a>
         <i class="las la-list app-sec-title-icon"></i>
-        <h2>{!!__('Edit')!!} {!!$data['title']!!}</h2>
+        <h2>{!!__('Edit')!!} {{ $data['title'] }}</h2>
         <div class="actions">
             <div class="action-buttons">
                 <button type="button" class="btn btn-with-icon btn-link  btn-outline" 
diff --git a/src/Litepie/Master/resources/views/master/show.blade.php b/src/Litepie/Master/resources/views/master/show.blade.php
index 3bfe2dd2..b1a63c81 100644
--- a/src/Litepie/Master/resources/views/master/show.blade.php
+++ b/src/Litepie/Master/resources/views/master/show.blade.php
@@ -3,7 +3,7 @@
     <div class="app-sec-title app-sec-title-with-icon app-sec-title-with-action">
         <a href="#" class="mobile-back-btn"><i class="las la-arrow-left"></i></a>
         <i class="las la-list app-sec-title-icon"></i>
-        <h2>{!!__('Show')!!} {!!$data['title']!!}</h2>
+        <h2>{!!__('Show')!!} {{ $data['title'] }}</h2>
         <div class="actions">
             <div class="action-buttons">
                 <button type="button" class="btn btn-with-icon btn-link" data-action='EDIT' data-load-to="#app-entry"
diff --git a/src/Litepie/Menu/resources/views/admin/edit.blade.php b/src/Litepie/Menu/resources/views/admin/edit.blade.php
index 1fb4d988..0a4ad628 100644
--- a/src/Litepie/Menu/resources/views/admin/edit.blade.php
+++ b/src/Litepie/Menu/resources/views/admin/edit.blade.php
@@ -1,7 +1,7 @@
 <div class="app-entry-form-wrap">
     <div class="app-sec-title app-sec-title-with-icon app-sec-title-with-action">
         <i class="lab la-product-hunt app-sec-title-icon"></i>
-        <h2>{{__('Edit')}} {!!$menu->name!!}</h2>
+        <h2>{{__('Edit')}} {{ $menu->name }}</h2>
         <div class="actions">
             <button type="button" class="btn btn-with-icon btn-link  btn-outline" data-action='UPDATE'
                 data-form="#form-edit" data-load-to="#sub-menu-edit" data-list="#item-list">
diff --git a/src/Litepie/Menu/resources/views/admin/menu/nestable.blade.php b/src/Litepie/Menu/resources/views/admin/menu/nestable.blade.php
index c6bd3204..94565792 100644
--- a/src/Litepie/Menu/resources/views/admin/menu/nestable.blade.php
+++ b/src/Litepie/Menu/resources/views/admin/menu/nestable.blade.php
@@ -8,7 +8,7 @@
                 <a href="#" class="app-submenu-edit" data-action="LOAD" data-load-to='#sub-menu-edit'
                     data_val="{!!$menu['eid']!!}"
                     data-href="{{guard_url('menu/submenu')}}/{!!$menu['eid']!!}">
-                    <span><i class="{!! !empty($menu->icon) ?  $menu->icon : '' !!}"></i> {!!$menu->name!!}</span>
+                    <span><i class="{!! !empty($menu->icon) ?  $menu->icon : '' !!}"></i> {{ $menu->name }}</span>
                 </a>
             </div>
             <div class="actions">
@@ -28,7 +28,7 @@
                 <a href="#" class="app-submenu-edit" data-action="LOAD" data-load-to='#sub-menu-edit'
                     data_val="{!!$menu['eid']!!}"
                     data-href="{{guard_url('menu/submenu')}}/{!!$menu['eid']!!}">
-                    <span><i class="{!! !empty($menu->icon) ?  $menu->icon : '' !!}"></i> {!!$menu->name!!}</span>
+                    <span><i class="{!! !empty($menu->icon) ?  $menu->icon : '' !!}"></i> {{ $menu->name }}</span>
                 </a>
             </div>
             <div class="actions">
diff --git a/src/Litepie/Menu/resources/views/admin/menu/sub/nestable.blade.php b/src/Litepie/Menu/resources/views/admin/menu/sub/nestable.blade.php
index 2756c0bb..adb6ca30 100644
--- a/src/Litepie/Menu/resources/views/admin/menu/sub/nestable.blade.php
+++ b/src/Litepie/Menu/resources/views/admin/menu/sub/nestable.blade.php
@@ -7,7 +7,7 @@
             <a href="#" class="app-submenu-edit" data-action="LOAD" data-load-to='#sub-menu-edit'
                 data_val="{!!$menu['eid']!!}"
                 data-href="{{guard_url('menu/submenu')}}/{!!$menu['eid']!!}">
-                <span><i class="{!! !empty($menu->icon) ?  $menu->icon : '' !!}"></i> {!!$menu->name!!}</span>
+                <span><i class="{!! !empty($menu->icon) ?  $menu->icon : '' !!}"></i> {{ $menu->name }}</span>
             </a>
         </div>
         <div class="actions">
@@ -27,7 +27,7 @@
             <a href='' class="app-submenu-edit" data_val="{!!$menu['eid']!!}"
                 data-href="{{guard_url('menu/submenu')}}/{!!$menu['eid']!!}" data-action="LOAD"
                 data-load-to='#sub-menu-edit'>
-                <span><i class="{!! !empty($menu->icon) ?  $menu->icon : '' !!}"></i> {!!$menu->name!!}</span>
+                <span><i class="{!! !empty($menu->icon) ?  $menu->icon : '' !!}"></i> {{ $menu->name }}</span>
 
             </a>
         </div>
diff --git a/src/Litepie/Menu/resources/views/admin/show.blade.php b/src/Litepie/Menu/resources/views/admin/show.blade.php
index 9ad0a722..270cc336 100644
--- a/src/Litepie/Menu/resources/views/admin/show.blade.php
+++ b/src/Litepie/Menu/resources/views/admin/show.blade.php
@@ -5,7 +5,7 @@
     <div class="app-sec-title app-sec-title-with-icon app-sec-title-with-action">
         <i class="lab la-product-hunt app-sec-title-icon"></i>
 
-        <h2>{!!$menu->name!!} </h2>
+        <h2>{{ $menu->name }} </h2>
 
         <div class="actions">
             <button type="button" class="btn btn-success btn-sm app-submenu-create" data_val="{{$menu['eid']}}"
diff --git a/src/Litepie/Notification/resources/views/default/notification/edit.blade.php b/src/Litepie/Notification/resources/views/default/notification/edit.blade.php
index 9c14aeec..05588825 100644
--- a/src/Litepie/Notification/resources/views/default/notification/edit.blade.php
+++ b/src/Litepie/Notification/resources/views/default/notification/edit.blade.php
@@ -2,7 +2,7 @@
     <div class="app-sec-title app-sec-title-with-icon app-sec-title-with-action">
         <a href="#" class="mobile-back-btn"><i class="las la-arrow-left"></i></a>
         <i class="las la-list app-sec-title-icon"></i>
-        <h2>{!!__('Edit')!!} {!!$data['title']!!}</h2>
+        <h2>{!!__('Edit')!!} {{ $data['title'] }}</h2>
         <div class="actions">
             <div class="action-buttons">
                 <button type="button" class="btn btn-with-icon btn-link  btn-outline" 
diff --git a/src/Litepie/Notification/resources/views/default/notification/show.blade.php b/src/Litepie/Notification/resources/views/default/notification/show.blade.php
index a42f0406..457d052e 100644
--- a/src/Litepie/Notification/resources/views/default/notification/show.blade.php
+++ b/src/Litepie/Notification/resources/views/default/notification/show.blade.php
@@ -3,7 +3,7 @@
     <div class="app-sec-title app-sec-title-with-icon app-sec-title-with-action">
         <a href="#" class="mobile-back-btn"><i class="las la-arrow-left"></i></a>
         <i class="las la-list app-sec-title-icon"></i>
-        <h2>{!!__('Show')!!} {!!$data['title']!!}</h2>
+        <h2>{!!__('Show')!!} {{ $data['title'] }}</h2>
         <div class="actions">
             <div class="action-buttons">
                 <button type="button" class="btn btn-with-icon btn-link" data-action='EDIT' data-load-to="#app-entry"
diff --git a/src/Litepie/Role/resources/views/default/permission/edit.blade.php b/src/Litepie/Role/resources/views/default/permission/edit.blade.php
index f62cb7f3..337d9a48 100644
--- a/src/Litepie/Role/resources/views/default/permission/edit.blade.php
+++ b/src/Litepie/Role/resources/views/default/permission/edit.blade.php
@@ -2,7 +2,7 @@
     <div class="app-sec-title app-sec-title-with-icon app-sec-title-with-action">
         <a href="#" class="mobile-back-btn"><i class="las la-arrow-left"></i></a>
         <i class="las la-list app-sec-title-icon"></i>
-        <h2>{!!__('Edit')!!} {!!$data['title']!!}</h2>
+        <h2>{!!__('Edit')!!} {{ $data['title'] }}</h2>
         <div class="actions">
             <div class="action-buttons">
                 <button type="button" class="btn btn-with-icon btn-link  btn-outline" 
diff --git a/src/Litepie/Role/resources/views/default/permission/show.blade.php b/src/Litepie/Role/resources/views/default/permission/show.blade.php
index 1a0a87db..a97126bf 100644
--- a/src/Litepie/Role/resources/views/default/permission/show.blade.php
+++ b/src/Litepie/Role/resources/views/default/permission/show.blade.php
@@ -3,7 +3,7 @@
     <div class="app-sec-title app-sec-title-with-icon app-sec-title-with-action">
         <a href="#" class="mobile-back-btn"><i class="las la-arrow-left"></i></a>
         <i class="las la-list app-sec-title-icon"></i>
-        <h2>{!!__('Show')!!} {!!$data['title']!!}</h2>
+        <h2>{!!__('Show')!!} {{ $data['title'] }}</h2>
         <div class="actions">
             <div class="action-buttons">
                 <button type="button" class="btn btn-with-icon btn-link" data-action='EDIT' data-load-to="#app-entry"
diff --git a/src/Litepie/Role/resources/views/default/role/edit.blade.php b/src/Litepie/Role/resources/views/default/role/edit.blade.php
index f28fc081..6b6eb4c4 100644
--- a/src/Litepie/Role/resources/views/default/role/edit.blade.php
+++ b/src/Litepie/Role/resources/views/default/role/edit.blade.php
@@ -2,7 +2,7 @@
     <div class="app-sec-title app-sec-title-with-icon app-sec-title-with-action">
         <a href="#" class="mobile-back-btn"><i class="las la-arrow-left"></i></a>
         <i class="las la-list app-sec-title-icon"></i>
-        <h2>{!!__('Edit')!!} {!!$data['title']!!}</h2>
+        <h2>{!!__('Edit')!!} {{ $data['title'] }}</h2>
         <div class="actions">
             <div class="action-buttons">
                 <button type="button" class="btn btn-with-icon btn-link  btn-outline" 
diff --git a/src/Litepie/Role/resources/views/default/role/show.blade.php b/src/Litepie/Role/resources/views/default/role/show.blade.php
index 4e5130dd..1c338849 100644
--- a/src/Litepie/Role/resources/views/default/role/show.blade.php
+++ b/src/Litepie/Role/resources/views/default/role/show.blade.php
@@ -3,7 +3,7 @@
     <div class="app-sec-title app-sec-title-with-icon app-sec-title-with-action">
         <a href="#" class="mobile-back-btn"><i class="las la-arrow-left"></i></a>
         <i class="las la-list app-sec-title-icon"></i>
-        <h2>{!!__('Show')!!} {!!$data['title']!!}</h2>
+        <h2>{!!__('Show')!!} {{ $data['title'] }}</h2>
         <div class="actions">
             <div class="action-buttons">
                 <button type="button" class="btn btn-with-icon btn-link" data-action='EDIT' data-load-to="#app-entry"
diff --git a/src/Litepie/Setting/resources/views/edit.blade.php b/src/Litepie/Setting/resources/views/edit.blade.php
index 919fdb30..d93c5c8f 100755
--- a/src/Litepie/Setting/resources/views/edit.blade.php
+++ b/src/Litepie/Setting/resources/views/edit.blade.php
@@ -1,7 +1,7 @@
 <div class="app-entry-form-wrap">
     <div class="app-sec-title app-sec-title-with-icon app-sec-title-with-action">
         <i class="lab la-product-hunt app-sec-title-icon"></i>
-        <h2>{{__('Edit')}} {!!$setting->name!!}</h2>
+        <h2>{{__('Edit')}} {{ $setting->name }}</h2>
         <div class="actions">
             
             <button type="button" class="btn btn-with-icon btn-link  btn-outline" 
diff --git a/src/Litepie/Team/resources/views/edit.blade.php b/src/Litepie/Team/resources/views/edit.blade.php
index 1fb2a994..db111955 100644
--- a/src/Litepie/Team/resources/views/edit.blade.php
+++ b/src/Litepie/Team/resources/views/edit.blade.php
@@ -2,7 +2,7 @@
     <div class="app-sec-title app-sec-title-with-icon app-sec-title-with-action">
         <a href="#" class="mobile-back-btn"><i class="las la-arrow-left"></i></a>
         <i class="las la-list app-sec-title-icon"></i>
-        <h2>{!!__('Edit')!!} {!!$data['title']!!}</h2>
+        <h2>{!!__('Edit')!!} {{ $data['title'] }}</h2>
         <div class="actions">
             <div class="action-buttons">
                 <button type="button" class="btn btn-with-icon btn-link  btn-outline" 
diff --git a/src/Litepie/Team/resources/views/show.blade.php b/src/Litepie/Team/resources/views/show.blade.php
index 6ce3bcc9..81b47ce7 100644
--- a/src/Litepie/Team/resources/views/show.blade.php
+++ b/src/Litepie/Team/resources/views/show.blade.php
@@ -3,7 +3,7 @@
     <div class="app-sec-title app-sec-title-with-icon app-sec-title-with-action">
         <a href="#" class="mobile-back-btn"><i class="las la-arrow-left"></i></a>
         <i class="las la-list app-sec-title-icon"></i>
-        <h2>{!!__('Show')!!} {!!$data['title']!!}</h2>
+        <h2>{!!__('Show')!!} {{ $data['title'] }}</h2>
         <div class="actions">
             <div class="action-buttons">
                 <button type="button" class="btn btn-with-icon btn-link" data-action='EDIT' data-load-to="#app-entry"
diff --git a/src/Litepie/User/resources/views/client/edit.blade.php b/src/Litepie/User/resources/views/client/edit.blade.php
index 4f83b4ad..1cd92e7c 100644
--- a/src/Litepie/User/resources/views/client/edit.blade.php
+++ b/src/Litepie/User/resources/views/client/edit.blade.php
@@ -2,7 +2,7 @@
     <div class="app-sec-title app-sec-title-with-icon app-sec-title-with-action">
         <a href="#" class="mobile-back-btn"><i class="las la-arrow-left"></i></a>
         <i class="las la-list app-sec-title-icon"></i>
-        <h2>{!!__('Edit')!!} {!!$data['title']!!}</h2>
+        <h2>{!!__('Edit')!!} {{ $data['title'] }}</h2>
         <div class="actions">
             <div class="action-buttons">
                 <button type="button" class="btn btn-with-icon btn-link  btn-outline" 
diff --git a/src/Litepie/User/resources/views/client/show.blade.php b/src/Litepie/User/resources/views/client/show.blade.php
index 68c0c4d7..4db53804 100644
--- a/src/Litepie/User/resources/views/client/show.blade.php
+++ b/src/Litepie/User/resources/views/client/show.blade.php
@@ -3,7 +3,7 @@
     <div class="app-sec-title app-sec-title-with-icon app-sec-title-with-action">
         <a href="#" class="mobile-back-btn"><i class="las la-arrow-left"></i></a>
         <i class="las la-list app-sec-title-icon"></i>
-        <h2>{!!__('Show')!!} {!!$data['title']!!}</h2>
+        <h2>{!!__('Show')!!} {{ $data['title'] }}</h2>
         <div class="actions">
             <div class="action-buttons">
                 <button type="button" class="btn btn-with-icon btn-link" data-action='EDIT' data-load-to="#app-entry"
diff --git a/src/Litepie/User/resources/views/user/edit.blade.php b/src/Litepie/User/resources/views/user/edit.blade.php
index 781d30eb..f0f71c75 100644
--- a/src/Litepie/User/resources/views/user/edit.blade.php
+++ b/src/Litepie/User/resources/views/user/edit.blade.php
@@ -2,7 +2,7 @@
     <div class="app-sec-title app-sec-title-with-icon app-sec-title-with-action">
         <a href="#" class="mobile-back-btn"><i class="las la-arrow-left"></i></a>
         <i class="las la-list app-sec-title-icon"></i>
-        <h2>{!!__('Edit')!!} {!!$data['title']!!}</h2>
+        <h2>{!!__('Edit')!!} {{ $data['title'] }}</h2>
         <div class="actions">
             <div class="action-buttons">
                 <button type="button" class="btn btn-with-icon btn-link  btn-outline" 
diff --git a/src/Litepie/User/resources/views/user/show.blade.php b/src/Litepie/User/resources/views/user/show.blade.php
index 33aa6006..7f483646 100644
--- a/src/Litepie/User/resources/views/user/show.blade.php
+++ b/src/Litepie/User/resources/views/user/show.blade.php
@@ -3,7 +3,7 @@
     <div class="app-sec-title app-sec-title-with-icon app-sec-title-with-action">
         <a href="#" class="mobile-back-btn"><i class="las la-arrow-left"></i></a>
         <i class="las la-list app-sec-title-icon"></i>
-        <h2>{!!__('Show')!!} {!!$data['title']!!}</h2>
+        <h2>{!!__('Show')!!} {{ $data['title'] }}</h2>
         <div class="actions"> 
             <div class="action-buttons">
                 <button type="button" class="btn btn-with-icon btn-link" data-action='EDIT' data-load-to="#app-entry"