CVE-2026-110103: bbs-go through 4.4.6 Stored XSS via Image Upload Content-Type
bbs-go through 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML or SVG files by spoofing the multipart Content-Type in POST /api/upload. Attackers can upload script-bearing documents served inline from /res and send their URLs to administrators, executing script on the forum's origin.
Affected Software
Event History
Frequently Asked Questions
Who is most directly exposed to this issue?
Administrators who visit a URL for an attacker-uploaded document are directly exposed, because the script executes on the forum's origin. The attacker must be an authenticated user able to upload files.
What does an attacker need to do to exploit it?
The attacker spoofs the multipart Content-Type when sending a file to POST /api/upload, allowing an HTML or SVG document containing script to be uploaded. They then need to persuade an administrator to open the uploaded file's URL.
Does exploitation require interaction after the upload?
Yes. Uploading the file alone is not described as executing code; the attacker must send the inline-served /res URL to an administrator, who must visit it.