CVE-2026-38466: GazellePW Stored XSS Vulnerability

CVE-2026-38466 Overview

CVE-2026-38466 is a stored cross-site scripting (XSS) vulnerability in GazellePW (GazellePosterWall), an open-source private tracker platform derived from the Gazelle codebase. The flaw resides in the torrent remaster custom title feature at commit 86c4bedf727691b5a97af42a4864869d18446449. Authenticated users can inject arbitrary JavaScript through the remaster_custom_title parameter during torrent upload or edit operations. The payload is stored server-side and later rendered in torrent title output without adequate encoding.

Critical Impact

Any authenticated user can plant persistent JavaScript that executes in every visitor's browser session, enabling session theft, account takeover, and, per the referenced exploit chain, full database compromise.

Affected Products

• GazellePW (GazellePosterWall) at commit 86c4bedf727691b5a97af42a4864869d18446449
• Affected file: app/Upload.php (lines 231 and 556)
• Affected files: classes/torrents.class.php (line 1283) and sections/torrents/takeedit.php (lines 81, 212)

Discovery Timeline

• 2026-08-25 - CVE-2026-38466 published to NVD
• 2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-38466

Vulnerability Analysis

GazellePW accepts a remaster_custom_title field when users submit or edit torrents. The upload handler in app/Upload.php writes the value to the torrents table without applying HTML entity encoding or a strict allowlist. When torrent metadata is later assembled by classes/torrents.class.php and rendered in torrent listings and detail pages, the raw string is concatenated into HTML output. Any JavaScript embedded in the field executes in the browser of every user who views affected torrents.

The edit path in sections/torrents/takeedit.php re-introduces the same unsanitized field on updates, so remediating only the upload path leaves the edit path exploitable. A public exploit chain guide describes leveraging this XSS as the first stage in a 1-click attack path culminating in complete database compromise.

Root Cause

The root cause is missing output encoding on user-controlled torrent metadata. The remaster_custom_title parameter bypasses the sanitization applied to other torrent fields and is trusted at render time. This is a classic stored XSS pattern where input validation and context-aware output escaping are both absent from the affected code paths.

Attack Vector

An authenticated attacker with permission to upload or edit a torrent submits a payload such as an HTML <script> tag or event-handler attribute inside the remaster_custom_title field. The value is persisted in the database. Whenever another user, including administrators, loads a page that renders the torrent title, the payload runs under the origin of the tracker. Attackers can steal session cookies, invoke authenticated API actions, escalate privileges, or pivot to server-side compromise using chained functionality documented in the public exploit write-up.

See the Snaacky exploit chain guide and the upload handler source for technical details.

Detection Methods for CVE-2026-38466

Indicators of Compromise

• Torrent records whose remaster_custom_title column contains <, >, script, onerror, onload, javascript:, or other HTML/JS control tokens.
• Web server access logs showing POST requests to upload.php or torrents.php?action=takeedit from accounts that subsequently trigger unusual admin actions.
• Outbound requests from browsers of authenticated users to attacker-controlled domains shortly after loading torrent detail or browse pages.

Detection Strategies

• Run a SQL audit against the torrents table for regex matches on script tags or event-handler attributes in the remaster custom title column.
• Deploy Content Security Policy (CSP) reporting to surface inline script executions originating from tracker pages.
• Add web application firewall (WAF) rules that inspect the remaster_custom_title POST parameter for HTML/JS metacharacters and log matches for review.

Monitoring Recommendations

• Alert on administrator account activity, especially token or password changes, that follows a page view of a torrent authored by a low-reputation account.
• Monitor for anomalous session cookie usage across geographies or user agents, a common post-exploitation signal for stored XSS.
• Correlate authentication events with browser telemetry to identify credential replay stemming from stolen tokens.

How to Mitigate CVE-2026-38466

Immediate Actions Required

• Disable the torrent upload and edit endpoints, or restrict them to trusted staff, until the code is patched.
• Audit the torrents table and remove or neutralize any stored remaster_custom_title values containing HTML or JavaScript.
• Rotate administrator credentials and invalidate active sessions to contain potential prior exploitation.

Patch Information

No official upstream patch is referenced in the NVD entry at publication. Operators running the affected commit 86c4bedf727691b5a97af42a4864869d18446449 should apply local fixes that HTML-encode the remaster_custom_title value on output in classes/torrents.class.php and validate the input in both app/Upload.php and sections/torrents/takeedit.php. Track the GazellePW repository for upstream fixes.

Workarounds

• Apply a strict CSP that disallows inline scripts (script-src 'self') to blunt injected payloads while a code fix is prepared.
• Add server-side input validation that rejects HTML metacharacters in the remaster_custom_title field.
• Enforce output encoding by wrapping the rendered title in an HTML entity encoder (for example, display_str() used elsewhere in the Gazelle codebase).

# Example CSP header to reduce XSS impact
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"