# CVE-2026-38473: GazellePW stored XSS in subtitle deletion

Source: https://junglewise.ai/threats/cve-2026-38473-gazellepw-stored-xss-in-subtitle-deletion  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-25. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-38473 · Severity: medium · CVSS 5.4 · Published 2026-08-25

GazellePW is a peer-to-peer file sharing application that manages subtitles for torrents. An authenticated user can upload a subtitle file with a malicious filename, and when another user (or moderator) visits the subtitle deletion page, the unescaped filename is rendered in the HTML, allowing the attacker's JavaScript to execute in their browser and potentially steal session cookies or perform actions on their behalf.

Technologies: [Mosasauroidea GazellePW](https://junglewise.ai/threats/technologies/gazellepw). Vendors: [Mosasauroidea](https://junglewise.ai/threats/vendors/mosasauroidea).

## Quick answers

**Is CVE-2026-38473 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-38473 being exploited in the wild.

**How severe is CVE-2026-38473?** Medium severity, with a CVSS score of 5.4, published 25 August 2026.

**Which products and versions are affected?** Mosasauroidea GazellePW commit 86c4bedf727691b5a97af42a4864869d18446449 and potentially other versions.

**Is there a fix for CVE-2026-38473?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-38473 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-38473?** Check whether you run Mosasauroidea GazellePW at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a stored cross-site scripting (XSS) vulnerability in the subtitle deletion flow. The root cause is insufficient output encoding in the delete.php template: the `$Name` variable—which contains the subtitle filename—is retrieved from the database and rendered directly into HTML via `<?= $Name ?>` without any escaping. Although the filename is sanitized during upload via `db_string()`, the upload handler stores the user-supplied filename (`$File['name']`) directly. An authenticated attacker can upload a subtitle with a filename containing JavaScript (e.g., `test<img src=x onerror=alert(1)>.srt`), which persists in the database. When the uploader, a moderator, or any user accessing the delete page views the confirmation form, the payload executes in their browser context with their session privileges. The attack requires authentication to upload a subtitle and victim interaction (visiting the delete page), but no additional permissions.

## Affected products

- Mosasauroidea GazellePW commit 86c4bedf727691b5a97af42a4864869d18446449 and potentially other versions

## Timeline

- 2026-08-25: disclosed: CVE-2026-38473 published on NVD

## References

- [https://github.com/Mosasauroidea/GazellePW/blob/86c4bedf727691b5a97af42a4864869d18446449/sections/subtitles/delete.php](https://github.com/Mosasauroidea/GazellePW/blob/86c4bedf727691b5a97af42a4864869d18446449/sections/subtitles/delete.php)
- [https://github.com/Mosasauroidea/GazellePW/blob/86c4bedf727691b5a97af42a4864869d18446449/sections/subtitles/upload_handle.php](https://github.com/Mosasauroidea/GazellePW/blob/86c4bedf727691b5a97af42a4864869d18446449/sections/subtitles/upload_handle.php)

## Related threats

- [GazellePW broken access control in IP lock manager](https://junglewise.ai/threats/cve-2026-38474-gazellepw-broken-access-control-in-ip-lock-manager)
- [GazellePW stored XSS in forum reward comments](https://junglewise.ai/threats/cve-2026-38472-gazellepw-stored-xss-in-forum-reward-comments)
- [GazellePW broken access control in API user endpoint](https://junglewise.ai/threats/cve-2026-38470-gazellepw-broken-access-control-in-api-user-endpoint)
- [GazellePW SQL injection in tags manager](https://junglewise.ai/threats/cve-2026-38467-gazellepw-sql-injection-in-tags-manager)
- [GazellePW stored XSS in torrent remaster custom title](https://junglewise.ai/threats/cve-2026-38466-gazellepw-stored-xss-in-torrent-remaster-custom-title)