CVE-2026-38467

Name of the Vulnerable Software and Affected Versions GazellePW (GazellePosterWall) versions prior to commit 86c4bedf727691b5a97af42a4864869d18446449

Description A SQL injection issue exists in the tags manager. Remote authenticated users with users mod privileges can execute arbitrary SQL commands by sending a crafted POST request to the 'tools.php?action=manage tags' endpoint using the tagid or type parameters.

Recommendations Update GazellePW (GazellePosterWall) to a version including commit 86c4bedf727691b5a97af42a4864869d18446449 or later. As a temporary mitigation, restrict access to the 'tools.php?action=manage tags' endpoint or avoid using the tagid and type parameters until the update is applied.