CVE-2026-38465 Overview
CVE-2026-38465 is a stored cross-site scripting (XSS) vulnerability in GazellePW (GazellePosterWall), an open-source private tracker platform. The flaw affects commit 86c4bedf727691b5a97af42a4864869d18446449 and resides in the donor avatar mouse-over text feature. Remote authenticated users can inject arbitrary JavaScript through the avatar_mouse_over_text parameter. The application stores the payload and later renders it inside the avatar tooltip without adequate output encoding. Any user hovering over the attacker's avatar triggers execution of the injected script in their browser session.
Critical Impact
Authenticated attackers can execute arbitrary JavaScript in the browser context of any user who views their avatar tooltip, enabling session theft, credential harvesting, and full account takeover across the tracker community.
Affected Products
- GazellePW (GazellePosterWall) at commit 86c4bedf727691b5a97af42a4864869d18446449
- Deployments derived from the affected commit that expose the donor avatar mouse-over text feature
- Any downstream fork inheriting the unsanitized avatar_mouse_over_text parameter handling
Discovery Timeline
- 2026-08-25 - CVE-2026-38465 published to the National Vulnerability Database
- 2026-08-25 - Last updated in NVD database
Technical Details for CVE-2026-38465
Vulnerability Analysis
The vulnerability is a stored XSS flaw [CWE-79] in GazellePW's donor management workflow. Donors can customize a mouse-over text string associated with their avatar. The application accepts this string, persists it to the database through the donation manager, and later injects it into the HTML tooltip attribute rendered on user profile pages. The affected code paths are located in app/Manager/Donation.php, classes/users.class.php, and sections/user/user.php. Because the tooltip output does not enforce contextual HTML encoding, arbitrary script fragments survive round-tripping through storage and reach the DOM.
An attacker submits a JavaScript payload as their avatar_mouse_over_text value. Every authenticated user who subsequently hovers over the attacker's avatar loads and executes the payload under the tracker's origin. This grants the attacker access to session cookies, CSRF tokens, and any privileged actions the victim can perform, including administrative operations if a staff member is targeted. A published exploit chain overview describes chaining this primitive toward full database compromise.
Root Cause
The root cause is improper neutralization of user-supplied input during web page generation. The avatar_mouse_over_text parameter is stored without HTML entity encoding and rendered directly inside the avatar tooltip markup. See the donation manager source and the user rendering path for the vulnerable logic.
Attack Vector
Exploitation requires an authenticated account with donor privileges. The attacker submits a crafted tooltip string containing JavaScript. Any user rendering a page that displays the attacker's avatar becomes a victim once the tooltip loads. The profile section handler emits the unsanitized value into the response HTML. Refer to the referenced advisory for full technical reproduction steps.
Detection Methods for CVE-2026-38465
Indicators of Compromise
- Database entries in the users or donations tables containing <script>, onerror=, onmouseover=, javascript:, or encoded variants within avatar_mouse_over_text values.
- Outbound HTTP requests from user browsers to attacker-controlled domains sourced from tracker profile pages.
- Anomalous session token reuse or account modifications following interaction with donor profiles.
Detection Strategies
- Query the backend database for donor avatar tooltip fields containing HTML tags, event handlers, or URL-encoded script markers.
- Review web server access logs for POST requests to donation configuration endpoints carrying suspicious payloads in avatar_mouse_over_text.
- Inspect rendered profile pages for tooltip attributes that break out of expected string boundaries.
Monitoring Recommendations
- Alert on Content Security Policy violation reports originating from profile and browse pages.
- Correlate staff account logins that occur shortly after visits to donor profile pages.
- Track privilege changes, permission escalations, and API token generations triggered by administrative sessions.
How to Mitigate CVE-2026-38465
Immediate Actions Required
- Disable or clear the donor avatar mouse-over text feature until a patched build is deployed.
- Audit existing avatar_mouse_over_text records and purge entries containing HTML or script content.
- Rotate session cookies and API tokens for staff and privileged users who may have viewed donor profiles.
- Enforce a strict Content Security Policy prohibiting inline scripts on tracker pages.
Patch Information
No official upstream fix commit is referenced in the NVD entry at publication. Administrators running builds derived from commit 86c4bedf727691b5a97af42a4864869d18446449 should apply HTML entity encoding to the avatar_mouse_over_text value at the rendering points in classes/users.class.php and sections/user/user.php, and validate input on write in app/Manager/Donation.php. Monitor the GazellePW repository for upstream patches.
Workarounds
- Apply server-side sanitization that strips HTML tags and event-handler attributes from avatar_mouse_over_text on both write and read paths.
- Encode the tooltip value using context-appropriate HTML attribute encoding before insertion into the DOM.
- Restrict the donation feature to a vetted subset of users while remediation is validated.
# Configuration example: enforce a restrictive Content Security Policy
# in the web server to blunt stored XSS execution
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'; report-uri /csp-report"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
