# Xibo CMS digital signage platform has a server-side request forgery flaw

- Date: 2026-05-12
- Location: Global
- Type: Vulnerability
- Sector: Vendor
- CVE: CVE-2026-42141
- Products: [Xibo](https://signagelist.org/products/xibo/)

NVD published a server-side request forgery flaw in Xibo CMS. Xibo is an open source digital signage platform with a web content management system and Windows display player software.

## Sources

- [CVE-2026-42141](https://nvd.nist.gov/vuln/detail/CVE-2026-42141) (NIST NVD)
- [https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-fwq8-c4gw-pxmh](https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-fwq8-c4gw-pxmh)

Page: https://signagelist.org/incidents/2026-05-xibo-cms-digital-signage-platform-has-a/