Executive brief
GazellePW is a peer-to-peer file sharing application that manages subtitles for torrents. An authenticated user can upload a subtitle file with a malicious filename, and when another user (or moderator) visits the subtitle deletion page, the unescaped filename is rendered in the HTML, allowing the attacker's JavaScript to execute in their browser and potentially steal session cookies or perform actions on their behalf.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in the subtitle deletion flow. The root cause is insufficient output encoding in the delete.php template: the `$Name` variable—which contains the subtitle filename—is retrieved from the database and rendered directly into HTML via `<?= $Name ?>` without any escaping. Although the filename is sanitized during upload via `db_string()`, the upload handler stores the user-supplied filename (`$File['name']`) directly. An authenticated attacker can upload a subtitle with a filename containing JavaScript (e.g., `test<img src=x onerror=alert(1)>.srt`), which persists in the database. When the uploader, a moderator, or any user accessing the delete page views the confirmation form, the payload executes in their browser context with their session privileges. The attack requires authentication to upload a subtitle and victim interaction (visiting the delete page), but no additional permissions.
Affected products
- Mosasauroidea GazellePW commit 86c4bedf727691b5a97af42a4864869d18446449 and potentially other versions
Timeline
- 2026-08-25: disclosed: CVE-2026-38473 published on NVD