CVE-2026-2947: Rymcu Forest XSS Vulnerability

CVE-2026-2947 Overview

CVE-2026-2947 is a cross-site scripting (XSS) vulnerability affecting rymcu forest versions up to 0.0.5. The flaw resides in the updateUserInfo function within src/main/java/com/rymcu/forest/web/api/user/UserInfoController.java, part of the User Profile Handler component. An authenticated attacker can inject malicious script content through user profile fields, which is later rendered in other users' browsers. The exploit has been disclosed publicly. According to the disclosure, the vendor was contacted before public disclosure but did not respond. The weakness is classified under CWE-79.

Critical Impact
Authenticated attackers can inject persistent JavaScript through profile updates, enabling session theft, account hijacking, and client-side actions against other forest users.

Affected Products

rymcu forest 0.0.1 through 0.0.5
Component: User Profile Handler (UserInfoController.java)
Function: updateUserInfo

Discovery Timeline

2026-02-22 - CVE-2026-2947 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2026-2947

Vulnerability Analysis

The vulnerability is a stored cross-site scripting (XSS) issue in the user profile update workflow of rymcu forest, a Java-based forum application. The updateUserInfo method in UserInfoController.java accepts user-supplied profile attributes without applying output encoding or input sanitization for HTML-bearing fields. Submitted content is persisted to the backend store and rendered later when other users view the profile, triggering script execution in their browser context. The flaw maps to [CWE-79]: Improper Neutralization of Input During Web Page Generation. Exploitation requires only low-privilege authenticated access and minimal user interaction, since browsing an attacker-controlled profile is sufficient to deliver the payload.

Root Cause

The root cause is missing input validation and output encoding in the updateUserInfo handler. The controller writes profile values directly to persistent storage, and downstream rendering returns the values without contextual escaping. Any field exposed by the profile API can carry HTML or JavaScript markup.

Attack Vector

An attacker authenticates to the forest application using any standard account. The attacker submits a crafted profile update containing JavaScript inside a profile attribute through the API exposed by UserInfoController. When another user, including an administrator, views the attacker's profile, the script executes with the victim's session. Possible outcomes include session token theft via document.cookie, forced state-changing requests against the forest API, and client-side phishing overlays. The attack is network-reachable and does not require local access or elevated privileges.

No verified proof-of-concept code is available in the referenced sources. Refer to the VulDB entry #347317 for additional technical context.

Detection Methods for CVE-2026-2947

Indicators of Compromise

Profile fields in the forest database containing <script>, onerror=, onload=, javascript:, or encoded variants such as <script
HTTP requests to /api/user/info or equivalent updateUserInfo endpoints with payloads containing HTML control characters in non-HTML fields
Outbound browser requests from authenticated user sessions to unknown external domains following profile views

Detection Strategies

Inspect the application database for stored profile values containing HTML tags or JavaScript event handlers using pattern queries.
Enable application-layer logging on the updateUserInfo endpoint and alert on payloads containing <, >, or known XSS sink keywords.
Deploy a web application firewall rule set, such as OWASP CRS, that flags reflected and stored XSS payloads on user profile API routes.

Monitoring Recommendations

Monitor browser-side errors and Content Security Policy (CSP) violation reports from forest application users for unexpected script sources.
Track session anomalies such as concurrent logins from disparate geographies after profile view events.
Audit administrator session activity for unexpected API calls following visits to non-administrator profiles.

How to Mitigate CVE-2026-2947

Immediate Actions Required

Restrict access to the forest application to trusted users until a fix is available, since the vendor has not responded to disclosure.
Sanitize existing profile records by stripping HTML tags from stored user profile fields in the database.
Apply a strict Content Security Policy (CSP) that blocks inline scripts and disallows untrusted script sources.

Patch Information

No official vendor patch has been published. The disclosure notes that the rymcu maintainers did not respond to outreach. Organizations running rymcu forest 0.0.5 or earlier should treat the deployment as unpatched and apply compensating controls. Track the VulDB advisory and the upstream rymcu/forest repository for any future patch release.

Workarounds

Place the forest application behind a web application firewall configured to block HTML and JavaScript payloads on the user profile update endpoint.
Implement server-side input validation that rejects profile updates containing <, >, or &# sequences in non-HTML fields.
Apply HTML entity encoding to all user profile attributes at rendering time within forest templates and JSON responses consumed by the frontend.
Disable or hide profile fields that are not essential to forum operation to reduce the attack surface.

bash

# Example nginx rule to block obvious XSS payloads on the profile update endpoint
location /api/user/info {
    if ($request_body ~* "(<script|onerror=|onload=|javascript:)") {
        return 403;
    }
    proxy_pass http://forest_backend;
}