CVE-2026-38466 in GazellePW
Summary
by MITRE • 08/26/2026
A Stored XSS vulnerability in the torrent remaster custom title feature in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users to inject arbitrary JavaScript via the remaster_custom_title parameter, which is stored during torrent upload or edit and later rendered in torrent title output.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified as a Stored Cross-Site Scripting (XSS) flaw within GazellePW, specifically affecting the custom title feature for torrents, represents a significant security risk to authenticated users of the platform. This issue stems from insufficient input validation and sanitization mechanisms when processing the remaster_custom_title parameter during torrent upload or editing operations. Unlike reflected XSS attacks where malicious scripts are executed immediately through a crafted URL, this vulnerability involves persistent storage of the injected payload on the server side. When an attacker successfully uploads or edits a torrent with a specially crafted custom title containing JavaScript code, that content is saved directly into the application's database without proper encoding or filtering. Consequently, every subsequent user who views the affected torrent page will have their browser execute the malicious script in the context of the vulnerable web application.
From a technical perspective, the core flaw lies in the failure to escape special characters within the remaster_custom_title field before rendering it into HTML output. This lack of proper contextual encoding allows raw JavaScript code to be interpreted by the client-side parser rather than being treated as inert text data. The persistence of this payload means that the attack does not require social engineering tricks like phishing links; instead, simply accessing a compromised torrent entry is sufficient to trigger execution. This characteristic significantly lowers the barrier for exploitation and increases the potential blast radius, as any authenticated user interacting with the platform becomes a potential victim without needing to click on external malicious resources.
The operational impact of this vulnerability extends beyond simple script execution. Attackers can leverage stored XSS to perform session hijacking by stealing authentication cookies or tokens displayed in browser storage, thereby gaining unauthorized access to victim accounts. Furthermore, the attacker could manipulate page content, deface the user interface, or redirect users to malicious external sites designed for further exploitation such as credential harvesting or malware distribution. In platforms handling sensitive data or community interactions like GazellePW, this can lead to severe reputational damage and loss of trust among the user base. The ability to execute arbitrary JavaScript also opens avenues for keylogging within the application context if specific DOM elements are targeted, potentially capturing sensitive information entered by users during their session.
This vulnerability aligns with CWE-79, which classifies Improper Neutralization of Input During Web Page Generation as a Common Weakness Enumeration identifier for Cross-Site Scripting flaws. The attack vector corresponds to the ATT&CK technique T1059.007, specifically JavaScript execution within web browsers, and falls under the broader category of Client-side Injection attacks. Mitigation strategies must focus on implementing robust input validation at both the client and server levels, ensuring that only expected character sets are accepted for custom titles. More critically, developers must enforce strict output encoding based on the context in which data is rendered, such as HTML entity encoding to prevent script interpretation. Additionally, deploying a Content Security Policy (CSP) header can provide an additional layer of defense by restricting the sources from which scripts are allowed to load and execute, thereby mitigating the impact even if input sanitization fails. Regular security audits and penetration testing focusing on persistent storage vulnerabilities are essential to maintain the integrity of such web applications.