CVE-2026-38473 Mosasauroidea CVE debrief

Who should care

Administrators and users of GazellePW (GazellePosterWall) should be aware of this vulnerability and take necessary precautions to prevent exploitation. This includes reviewing and applying vendor patches or updates, restricting subtitle filename input, and monitoring for suspicious activity. Additionally, security teams and vulnerability management teams should prioritize this vulnerability based on its severity and potential impact on their environment.

Technical summary

The CVE-2026-38473 vulnerability is a Stored XSS issue in GazellePW (GazellePosterWall). An authenticated user can inject JavaScript via a crafted subtitle filename during upload. The filename is stored and later rendered in /subtitles.php?action=delete, allowing for JavaScript execution. This vulnerability can be mitigated by restricting subtitle filename input to prevent JavaScript injection, implementing Content Security Policy (CSP) to mitigate XSS attacks, and monitoring /subtitles.php?action=delete for suspicious activity.

Defensive priority

Authenticated users with low privileges can inject JavaScript via crafted subtitle filenames, allowing for Stored XSS attacks.

Recommended defensive actions

• Inventory and verify the presence of GazellePW (GazellePosterWall) in your environment.
• Restrict subtitle filename input to prevent JavaScript injection.
• Implement Content Security Policy (CSP) to mitigate XSS attacks.
• Monitor /subtitles.php?action=delete for suspicious activity.
• Apply vendor remediation or patches when available.

Evidence notes

The CVE-2026-38473 record indicates a Stored XSS vulnerability in GazellePW (GazellePosterWall). Evidence from the NVD and CVE Program suggests that an authenticated user can inject JavaScript via a crafted subtitle filename during upload, which is later rendered in /subtitles.php?action=delete. To verify and mitigate this vulnerability, defenders should review the official CVE record and NVD details, assess their environment for affected deployments, and apply vendor patches or mitigations as available. They should also monitor for suspicious activity and implement compensating controls if necessary.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.