CVE-2026-110103

5.4Medium

Published 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

5.4Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: Required
Impact: Limited impact
Weakness: CWE-79

Impact

Authenticated attackers can run arbitrary JavaScript in an administrator's browser session by uploading malicious HTML or SVG files and tricking them into visiting the link. They need valid user credentials to upload files and an administrator to open the hosted URL.

Root cause

The upload handler trusts the user-supplied multipart Content-Type header without validating the actual file content, allowing HTML and SVG uploads to be served inline from /res.

Affected systems

bbs-go through 4.4.6

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Fix & remediation

Upgrade to a version containing commit 5bebf98bb9e0ac5162d4f8faf7a65fc0d496a362 (versions newer than 4.4.6). If you cannot patch immediately, block requests matching HTML or SVG content types to POST /api/upload or configure the reverse proxy to serve files under /res with Content-Disposition: attachment.

shell

$ git pull && git checkout 5bebf98bb9e0ac5162d4f8faf7a65fc0d496a362 && go build

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

bbs-go through 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML or SVG files by spoofing the multipart Content-Type in POST /api/upload. Attackers can upload script-bearing documents served inline from /res and send their URLs to administrators, executing script on the forum's origin.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-110103