CVE-2026-38473

Name of the Vulnerable Software and Affected Versions GazellePW (GazellePosterWall) versions prior to commit 86c4bedf727691b5a97af42a4864869d18446449

Description A Stored Cross-Site Scripting (XSS) issue exists in the subtitle deletion flow. Remote authenticated users can inject arbitrary JavaScript through a specially crafted subtitle filename. This malicious script is stored during the upload process and subsequently executed when rendered at the '/subtitles.php?action=delete' endpoint. Stored XSS occurs when an application receives data from a user and includes that data within its later HTTP responses in an unsafe way.

Recommendations Update GazellePW (GazellePosterWall) to commit 86c4bedf727691b5a97af42a4864869d18446449 or a newer version.