CVE-2026-38466

Deferred Deferred - Pending Action

Stored XSS in GazellePW Torrent Remaster Title Feature

Publication date: 2026-08-25

Last updated on: 2026-08-31

Assigner: MITRE

Description

A Stored XSS vulnerability in the torrent remaster custom title feature in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users to inject arbitrary JavaScript via the remaster_custom_title parameter, which is stored during torrent upload or edit and later rendered in torrent title output.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-25

Last Modified

2026-08-31

Generated

2026-09-15

AI Q&A

2026-08-26

EPSS Evaluated

2026-09-13

NVD

CVE-2026-38466

EUVD

EUVD-2026-66171

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a Stored Cross-Site Scripting (XSS) vulnerability in GazellePW (GazellePosterWall). It allows authenticated users to inject malicious JavaScript code via the remaster_custom_title parameter during torrent upload or editing. The injected script is stored and later executed when the torrent title is displayed.

Detection Guidance

To detect this Stored XSS vulnerability in GazellePW, inspect HTTP requests during torrent upload or edit for the remaster_custom_title parameter. Check server responses for stored JavaScript execution in torrent titles. Manually review database entries for injected scripts in the remaster_custom_title field.

Impact Analysis

An attacker could exploit this to execute arbitrary JavaScript in the context of other users' browsers. This could lead to session hijacking, defacement of pages, or theft of sensitive data like cookies or tokens if users interact with the malicious payload.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations may face compliance breaches if user data is compromised through this exploit.

Mitigation Strategies

Disable the torrent remaster custom title feature in GazellePW until a patch is applied. Review uploaded torrents for suspicious JavaScript in titles and remove any malicious entries. Implement input validation to block JavaScript injection in the remaster_custom_title parameter.

Hi! I’m here to help you understand CVE-2026-38466. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70