CVE-2026-38466: XSS

Published Aug 25, 2026

Updated

A Stored XSS vulnerability in the torrent remaster custom title feature in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users to inject arbitrary JavaScript via the remastercustomtitle parameter, which is stored during torrent upload or edit and later rendered in torrent title output.

Affected Software

1 affected component

GazellePW GazellePosterWall

Event History

Aug 25, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·10:17 PM

Description

Frequently Asked Questions

Who can exploit this issue?

A remote authenticated user who can upload or edit a torrent can inject JavaScript through the remaster_custom_title parameter.

When does the malicious script execute?

The supplied value is stored during torrent upload or editing and executes later when the torrent title output renders it.

How can administrators check for possible exposure?

Review torrent upload and edit records for suspicious HTML or JavaScript content in remaster custom title values, especially values containing script-like markup or event-handler attributes.

CVE-2026-38466: XSS

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

When does the malicious script execute?

How can administrators check for possible exposure?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

When does the malicious script execute?

How can administrators check for possible exposure?