CVE-2026-38469: GazellePW Stored XSS Vulnerability

CVE-2026-38469 Overview

CVE-2026-38469 is a stored Cross-Site Scripting (XSS) vulnerability in GazellePW (GazellePosterWall), an open-source private tracker platform. The flaw exists in the custom bonus title feature at commit 86c4bedf727691b5a97af42a4864869d18446449. Remote authenticated users can inject arbitrary JavaScript through the title parameter in /bonus.php and /user.php?action=staff_tool. The injected payload persists in the application and executes in the browsers of other users who view the affected pages, including staff members with elevated privileges.

Critical Impact
Authenticated attackers can store JavaScript payloads that execute against staff and other users, enabling session theft, forced actions, and full database compromise when chained with staff-tool functionality.

Affected Products

GazellePW (GazellePosterWall) at commit 86c4bedf727691b5a97af42a4864869d18446449
app/Bonus.php handler for custom bonus title storage
sections/bonus/title.php and /user.php?action=staff_tool rendering paths

Discovery Timeline

2026-08-25 - CVE-2026-38469 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-38469

Vulnerability Analysis

The vulnerability is a stored XSS [CWE-79] in the custom bonus title feature. Authenticated users can submit an arbitrary title string that is persisted server-side and later rendered without adequate output encoding. Because the value is stored, the payload executes for every viewer of the affected page rather than requiring a per-request lure. Public reference material describes chaining the flaw into a one-click exploit sequence that results in full database compromise. See the Snaacky Exploit Chain Guide for the documented attack path.

Root Cause

The root cause is missing or insufficient contextual output encoding for user-supplied data in the bonus title workflow. The title parameter flows from the request into storage through app/Bonus.php and is later emitted into HTML by sections/bonus/title.php and by user-related views in classes/users.class.php. Because the value is rendered inside HTML context without safe escaping, script content in the title becomes executable markup. Relevant source lines are documented in the GazellePW Bonus File Code and GazellePW Bonus Title Code references.

Attack Vector

An authenticated attacker submits a crafted title to the bonus endpoint. The payload is stored and rendered whenever a victim accesses /bonus.php or a staff member opens /user.php?action=staff_tool to view the attacker's profile. Script execution happens in the victim's session context. When the victim is a staff account, the attacker can pivot the XSS into privileged actions exposed by the staff tools, as documented in the referenced GazellePW User Class Code.

No verified proof-of-concept code is available in this record. The public exploit chain reference above describes the end-to-end scenario without providing sanitized code in structured form.

Detection Methods for CVE-2026-38469

Indicators of Compromise

Bonus title values in the database that contain HTML tags such as <script>, <img onerror=...>, <svg onload=...>, or javascript: URIs.
Web server access logs showing POST requests to /bonus.php with title parameter values containing angle brackets, event handlers, or encoded script fragments.
Outbound requests from staff browsers to unfamiliar domains shortly after opening /user.php?action=staff_tool for a specific user profile.
Unexpected privileged actions initiated from staff accounts that correlate in time with staff tool views of a suspect account.

Detection Strategies

Query the users and bonus tables for stored title fields matching regular expressions for HTML tags, event handlers, or encoded script sequences.
Deploy a Content Security Policy (CSP) in report-only mode and monitor report-uri submissions for inline script violations on bonus and staff pages.
Inspect web application firewall logs for XSS signatures on POST bodies targeting /bonus.php.

Monitoring Recommendations

Alert on any staff-account session that fetches /user.php?action=staff_tool immediately followed by state-changing administrative requests from the same session.
Log and review all writes to bonus title fields, including the submitting user ID and source IP, for retrospective triage.
Baseline normal bonus title length and character distribution and alert on outliers containing markup.

How to Mitigate CVE-2026-38469

Immediate Actions Required

Audit the bonus and user tables for stored payloads and sanitize or delete any titles containing HTML or script content.
Restrict access to /bonus.php custom title functionality until output encoding is applied in the rendering paths.
Instruct staff to avoid opening /user.php?action=staff_tool for untrusted accounts until the codebase is patched.
Rotate session cookies and staff credentials that may have been exposed through prior script execution.

Patch Information

No vendor patch is referenced in the NVD record for CVE-2026-38469. The vulnerability is documented against commit 86c4bedf727691b5a97af42a4864869d18446449 of the upstream repository. Operators running GazellePW should apply context-aware HTML escaping to the title field on output in sections/bonus/title.php and the user rendering paths in classes/users.class.php, and validate input on write in app/Bonus.php. Review the referenced GazellePW User Class Code location to confirm the sanitization boundary.

Workarounds

Apply a strict Content Security Policy that forbids inline scripts and restricts script sources to trusted origins, reducing execution of injected payloads.
Deploy a web application firewall rule that blocks HTML tags and JavaScript event handlers in the title POST parameter on /bonus.php.
Disable or gate the custom bonus title feature at the reverse proxy until code-level output encoding is deployed.

bash

# Example nginx rule to block obvious XSS payloads in the bonus title parameter
location = /bonus.php {
    if ($request_method = POST) {
        set $block 0;
        if ($request_body ~* "title=[^&]*(<|%3C)(script|img|svg|iframe|body|onerror|onload)") {
            set $block 1;
        }
        if ($block = 1) { return 403; }
    }
    proxy_pass http://gazellepw_upstream;
}