CVE-2026-38473 in GazellePW
Summary
by MITRE • 08/25/2026
A Stored XSS vulnerability in the subtitle deletion flow in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users to inject arbitrary JavaScript via a crafted subtitle filename, which is stored during upload and later rendered in /subtitles.php?action=delete.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified as CVE-2023-XXXXX represents a critical Stored Cross-Site Scripting (XSS) flaw within the GazellePW application, specifically targeting the subtitle management subsystem. This security defect arises from insufficient input validation and sanitization mechanisms during the file upload process for subtitles. When an authenticated user uploads a subtitle file with a maliciously crafted filename containing JavaScript code, the system fails to properly escape or neutralize these special characters before storing them in the backend database. Consequently, the injected script becomes persistent within the application's data store rather than being executed transiently during input processing. This persistence distinguishes it from reflected XSS attacks and significantly increases its potential impact by allowing the malicious payload to be served to multiple victims without requiring further interaction with the attacker for each instance of execution.
The operational exploitation vector is triggered when an administrator or authorized user accesses the subtitle deletion interface located at /subtitles.php?action=delete. Upon rendering this page, the application retrieves the stored filename data from the database and injects it directly into the HTML output without adequate context-aware encoding. As a result, any browser viewing this administrative panel will execute the embedded JavaScript code in the security context of the GazellePW domain. This allows an attacker to perform actions on behalf of the victim user, such as stealing session cookies, capturing authentication tokens, or performing state-changing requests that the authenticated user is privileged to make. The attack does not require social engineering beyond initial upload access, making it a high-risk vulnerability for any instance where multiple users have upload privileges and administrators regularly manage subtitle files.
From a classification perspective, this flaw aligns with CWE-79: Improper Neutralization of Input During Web Page Generation, commonly known as Cross-site Scripting. Specifically, the stored nature of the payload places it within the domain of persistent XSS attacks where the malicious script is saved on the target server and executed whenever the affected page is loaded. In terms of adversary tactics, this vulnerability facilitates techniques associated with MITRE ATT&CK T1059: Command and Control Scripting Interpreter if used for remote access or T1204: User Execution if leveraged to trick users into clicking malicious links generated via the stolen session data. The lack of output encoding in the deletion interface highlights a fundamental gap in the application's security architecture regarding how dynamic content is handled during rendering operations.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. Immediate action should involve patching the source code to implement strict input validation on all file upload fields, ensuring that only alphanumeric characters, underscores, hyphens, and standard punctuation are permitted in subtitle filenames. Additionally, output encoding must be applied consistently across all views, particularly in pages like /subtitles.php?action=delete, using context-appropriate escaping techniques such as HTML entity encoding for data inserted into HTML body contexts. Developers should also consider implementing Content Security Policy headers to mitigate the impact of any future XSS vulnerabilities by restricting script execution sources. Regular security audits and integration of static application security testing tools in the development pipeline can help detect similar input handling flaws before they reach production environments, ensuring a more robust defense against web-based injection attacks.