CVE-2026-38472: GazellePW Stored XSS Vulnerability

CVE-2026-38472 Overview

CVE-2026-38472 is a stored Cross-Site Scripting (XSS) vulnerability in GazellePW (GazellePosterWall), an open-source forum and tracker platform. The flaw exists in the forum reward comment functionality at commit 86c4bedf727691b5a97af42a4864869d18446449. Remote attackers can inject arbitrary JavaScript through the c parameter submitted to /forums.php?action=ajax_get_jf. The injected payload is later rendered inside the data-tooltip attribute at /forums.php?action=viewthread and interpreted as HTML by the Tooltipster JavaScript library. Any authenticated user viewing an affected thread triggers script execution in their browser context.

Critical Impact
Attackers can hijack authenticated sessions, steal credentials, and pivot to full database compromise through a documented one-click exploit chain.

Affected Products

GazellePW (GazellePosterWall) at commit 86c4bedf727691b5a97af42a4864869d18446449
sections/forums/ajax_get_jf.php reward comment handler
sections/forums/thread.php thread view renderer

Discovery Timeline

2026-08-25 - CVE-2026-38472 published to the National Vulnerability Database
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-38472

Vulnerability Analysis

The vulnerability is a stored XSS issue [CWE-79] rooted in inconsistent output encoding between two rendering contexts. User-controlled input from the c parameter is persisted through the reward comment feature and later placed inside an HTML attribute consumed by the Tooltipster tooltip library. Tooltipster is configured to interpret the data-tooltip value as HTML rather than plain text. As a result, standard HTML-attribute escaping alone does not prevent script execution, because the value is re-parsed as HTML by client-side JavaScript when the tooltip renders.

An attacker who can post a forum reward comment can store a payload that executes for every user who views the affected thread. Because GazellePW is a session-authenticated application, script execution occurs in the victim's authenticated origin. A published exploit chain demonstrates escalation from this XSS to full database compromise via chained requests performed under a privileged user's session.

Root Cause

The root cause is a mismatch between how reward comment input is stored and how it is rendered. The ajax_get_jf.php endpoint accepts the c parameter without HTML sanitization sufficient for a JavaScript-interpreted attribute context. The thread.php view emits the value into data-tooltip, and Tooltipster's HTML-content mode evaluates that attribute as markup. The combined behavior violates contextual output encoding requirements for HTML attributes that are later reinterpreted as HTML.

Attack Vector

Exploitation requires the ability to submit forum reward comments, which is available to authenticated forum users. An attacker submits a crafted c parameter containing an HTML payload to /forums.php?action=ajax_get_jf. The payload is stored and served to any user who loads /forums.php?action=viewthread for the affected thread. When Tooltipster initializes the tooltip, it parses the attacker-controlled attribute as HTML, executing embedded JavaScript in the victim's browser. The public Snaacky exploit chain writeup documents chaining this primitive to compromise the underlying database.

Refer to the vulnerable sinks in ajax_get_jf.php line 27 and thread.php line 725.

Detection Methods for CVE-2026-38472

Indicators of Compromise

Requests to /forums.php?action=ajax_get_jf containing <script>, <img, onerror=, onload=, or javascript: substrings in the c parameter.
Reward comment records in the database whose stored content includes HTML tags or event-handler attributes.
Unexpected outbound requests from browser sessions immediately after loading /forums.php?action=viewthread, indicating token or cookie exfiltration.
Administrative actions performed from thread-view referrers, particularly account changes or database export endpoints hit shortly after a thread visit.

Detection Strategies

Inspect web server logs for POST requests to ajax_get_jf.php and flag c values containing angle brackets, HTML entities, or JavaScript keywords.
Deploy a Web Application Firewall (WAF) rule that blocks HTML tags and event-handler attributes in reward comment submissions.
Query the reward comments table for stored rows containing <, >, or on\w+= patterns to identify payloads already at rest.
Correlate viewthread page loads with anomalous same-session API calls from the same client, which can indicate stored XSS execution.

Monitoring Recommendations

Enable a strict Content Security Policy (CSP) in report-only mode and monitor script-src violation reports for indicators of injected inline scripts.
Alert on privileged accounts loading forum threads immediately before high-impact API calls such as user role changes or data exports.
Track Tooltipster initialization errors and unusual DOM mutations in browser telemetry where available.

How to Mitigate CVE-2026-38472

Immediate Actions Required

Restrict or disable the forum reward comment feature until a patched build is deployed.
Purge stored reward comment content containing HTML tags or event-handler attributes from the database.
Rotate session secrets and force reauthentication for administrative accounts that may have viewed affected threads.
Reconfigure Tooltipster to render tooltip content as text rather than HTML on the thread view.

Patch Information

No vendor patch is referenced in the current NVD record. Operators tracking upstream should monitor the GazellePW repository for commits that add contextual output encoding to sections/forums/ajax_get_jf.php and remove HTML interpretation from the data-tooltip attribute in sections/forums/thread.php.

Workarounds

Apply server-side HTML sanitization to the c parameter in ajax_get_jf.php using an allowlist library before persistence.
Change the Tooltipster instance on the thread view to use contentAsHTML: false so attribute content is treated as text.
Deploy a strict Content Security Policy that disallows inline scripts and restricts script-src to trusted origins.
Add virtual patching at the reverse proxy or WAF layer to block HTML metacharacters in the c parameter.

bash

# Example Nginx virtual-patch rule blocking HTML metacharacters in the c parameter
location = /forums.php {
    if ($arg_action = "ajax_get_jf") {
        if ($args ~* "(^|&)c=[^&]*(%3C|<|%3E|>|on[a-z]+=|javascript:)") {
            return 403;
        }
    }
}