CVE-2026-2947
Remote XSS in rymcu forest User Profile Handler up to
Publication date: 2026-02-22
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| rymcu | forest | to 0.0.5 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2026-2947 is a cross-site scripting (XSS) vulnerability found in the rymcu forest software, versions up to 0.0.5. It exists in the function updateUserInfo within the UserInfoController.java file, part of the User Profile Handler component.'}, {'type': 'paragraph', 'content': 'The vulnerability occurs because the application fails to properly neutralize user-controllable input before including it in web page output, allowing attackers to inject malicious JavaScript code.'}, {'type': 'paragraph', 'content': "This can be exploited remotely by manipulating input parameters in the updateUserInfo function, requiring some user interaction. The injected script can execute when other users view the attacker's profile."}] [1, 2]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing remote attackers to execute malicious JavaScript code in the context of your web application.
Such cross-site scripting attacks can compromise data integrity and potentially lead to unauthorized actions performed on behalf of users, session hijacking, or theft of sensitive information.
Because the vulnerability is in the user profile update functionality, attackers can inject scripts that execute when other users view the compromised profiles, affecting multiple users.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability is a stored Cross-Site Scripting (XSS) issue in the updateUserInfo function of the UserInfoController.java file in rymcu forest up to version 0.0.5. Detection involves identifying malicious JavaScript code injected into user profile fields, especially signature fields.
Since the exploit is publicly available and the attack requires user interaction, detection can be performed by monitoring HTTP requests and responses involving the updateUserInfo endpoint for suspicious input patterns or scripts.
Specific commands are not provided in the available resources. However, general detection methods include:
- Using web application scanners or proxy tools (e.g., Burp Suite) to intercept and analyze requests to the updateUserInfo API for injected scripts.
- Searching server logs or database entries for suspicious JavaScript code in user profile fields.
- Employing security tools that detect XSS payloads in web application inputs.
What immediate steps should I take to mitigate this vulnerability?
No official mitigations or patches have been published by the vendor, and the vendor did not respond to the disclosure.
Immediate steps to mitigate this vulnerability include:
- Avoid using the affected version (0.0.5 and earlier) of rymcu forest if possible.
- Consider replacing the affected product with an alternative that does not have this vulnerability.
- Implement input validation and output encoding on the updateUserInfo function to neutralize user-controllable input before rendering it in web pages.
- Restrict user privileges to limit the ability to inject malicious scripts.
- Monitor for suspicious activity related to user profile updates.