CVE-2026-13536: GotoHTTP Cross-Site Scripting Vulnerability

CVE-2026-13536 Overview

CVE-2026-13536 is a reflected cross-site scripting (XSS) vulnerability in GotoHTTP versions up to 10.2. The flaw resides in the /reg.12x endpoint, where the sn parameter is echoed back to the response without proper sanitization. An attacker can craft a malicious URL that executes arbitrary JavaScript in the context of the victim's browser when clicked. The exploit has been publicly disclosed and is classified under [CWE-79].

The vendor has stated that the vulnerable parameter echo was removed from source code but that the affected URL is not exposed in normal browser use. A server-side update is deferred to the next release cycle.

Critical Impact
Remote attackers can execute arbitrary JavaScript in a victim's browser session by tricking users into visiting a crafted URL targeting the /reg.12x endpoint.

Affected Products

GotoHTTP versions up to and including 10.2
The /reg.12x endpoint handling the sn parameter
No official vendor CPE entries currently published in NVD

Discovery Timeline

2026-06-29 - CVE-2026-13536 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-13536

Vulnerability Analysis

The vulnerability is a reflected cross-site scripting flaw in GotoHTTP's remote access web interface. The /reg.12x handler accepts the sn argument from user-controlled input and reflects it into the HTTP response without applying output encoding or input sanitization. When a victim loads a crafted URL, the injected payload runs as JavaScript in the browser under the site's origin.

Reflected XSS enables session token theft, credential harvesting via injected forms, and arbitrary DOM manipulation. Because GotoHTTP is a remote access tool, successful exploitation could pivot to compromise of remote session data. The attack requires user interaction — the victim must click or otherwise load the crafted URL.

The vendor confirmed the parameter echo has been removed from source code but stated the URL is not reachable through the browser during normal product use, deferring a server upgrade to a future release.

Root Cause

The root cause is missing output encoding on the sn request parameter before it is written into the HTML response body of /reg.12x. User-supplied content is treated as trusted markup rather than data, allowing HTML and script tags to execute. This is a classic instance of [CWE-79], Improper Neutralization of Input During Web Page Generation.

Attack Vector

The attack is initiated remotely over the network and requires user interaction. An attacker crafts a URL targeting /reg.12x with a JavaScript payload in the sn query parameter. The victim clicks the link, typically delivered via phishing, chat, or a malicious redirect. The GotoHTTP server reflects the payload into the response, causing script execution in the victim's browser context.

Exploitation requires no authentication. The impact is limited to integrity of browser-side content, with no direct impact to server confidentiality or availability. Technical details are documented in the GitHub CVE Issue and VulDB entry for CVE-2026-13536.

Detection Methods for CVE-2026-13536

Indicators of Compromise

HTTP requests to /reg.12x containing sn= values with URL-encoded HTML tags, <script>, javascript:, or event handler attributes such as onerror and onload
Unusually long or obfuscated sn parameter values, especially those containing base64-encoded JavaScript
Referrer headers on GotoHTTP endpoints originating from external phishing domains or URL shorteners

Detection Strategies

Deploy web application firewall (WAF) signatures that inspect query strings on /reg.12x requests for XSS payload patterns
Enable request logging on the GotoHTTP web interface and alert on sn parameters containing angle brackets or script keywords
Correlate outbound DNS or HTTP requests from user endpoints with suspicious inbound GotoHTTP traffic to identify data exfiltration attempts following successful XSS execution

Monitoring Recommendations

Monitor endpoint browser telemetry for unexpected JavaScript execution on GotoHTTP-hosted origins
Aggregate GotoHTTP server access logs into a centralized SIEM and build alerting for anomalous sn parameter content
Review email and messaging security gateways for URLs referencing /reg.12x with encoded payloads

How to Mitigate CVE-2026-13536

Immediate Actions Required

Restrict access to the GotoHTTP web interface using network segmentation, IP allow-listing, or VPN gating until a fixed version is released
Train users to avoid clicking unverified links referencing GotoHTTP endpoints, particularly URLs containing /reg.12x?sn=
Enforce a strict Content Security Policy (CSP) at any upstream reverse proxy to block inline script execution from reflected payloads

Patch Information

The vendor confirmed removal of the unnecessary parameter echo from source code but has not released a corresponding server update for versions up to 10.2. A fix is expected in the next GotoHTTP release alongside other features. Consult the VulDB Vulnerability #374544 entry for status updates and monitor the vendor site for the next scheduled release.

Workarounds

Place GotoHTTP behind a reverse proxy that strips or sanitizes the sn query parameter on requests to /reg.12x
Deploy WAF rules that block requests to /reg.12x containing HTML metacharacters or script, onerror, onload, and javascript: tokens in query strings
Configure browser-side protections such as X-XSS-Protection, X-Content-Type-Options: nosniff, and a restrictive CSP header on the hosting infrastructure

bash

# Example NGINX reverse proxy rule to block XSS payloads on the vulnerable endpoint
location /reg.12x {
    if ($args ~* "(<|%3C)\s*script|onerror=|onload=|javascript:") {
        return 403;
    }
    proxy_pass http://gotohttp_backend;
}