CVE-2026-110103
Received Received - Intake

Stored XSS in BBS-Go via Malicious File Upload

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: VulnCheck

Description
bbs-go through 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML or SVG files by spoofing the multipart Content-Type in POST /api/upload. Attackers can upload script-bearing documents served inline from /res and send their URLs to administrators, executing script on the forum's origin.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-110103
EUVD
EUVD-2026-98936

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mlogclub bbs-go 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a stored cross-site scripting (XSS) flaw in bbs-go versions up to 4.4.6. Authenticated users can upload HTML or SVG files by manipulating the Content-Type in a POST request to /api/upload. These malicious files are stored and served from /res, allowing attackers to send URLs that execute scripts in the forum's origin when accessed by administrators.

Detection Guidance

Check for uploaded HTML or SVG files in the /res directory of your bbs-go instance. Look for files with script content or unusual Content-Type headers in POST requests to /api/upload.

Impact Analysis

If exploited, this vulnerability could allow attackers to execute arbitrary scripts in the context of the forum, potentially stealing session cookies, performing actions on behalf of users, or spreading malware. Administrators viewing the malicious files would be most affected.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's integrity and confidentiality requirements. For HIPAA, it may compromise protected health information integrity. Both standards require protection against such breaches, and this flaw could result in non-compliance.

Mitigation Strategies

Upgrade bbs-go to a version beyond 4.4.6. Restrict file uploads to trusted users and validate Content-Type headers strictly. Monitor /res directory for unexpected files.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-110103. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart