A Stored XSS vulnerability in the subtitle deletion flow in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows… (CVE-2026-38473)

The vulnerability is a stored XSS in GazellePW's subtitle deletion functionality. Authenticated users can upload subtitles with malicious JavaScript embedded in the filename. This script is stored and later executed when the deletion page renders the filename, allowing script injection in a context with user privileges. The vulnerability is tracked as CVE-2026-38473 and corresponds to CWE-79. There is no information about affected versions or available patches.

Successful exploitation allows remote authenticated users to execute arbitrary JavaScript in the context of the affected application, potentially leading to session hijacking, privilege escalation within the web application, or other client-side impacts. The vulnerability does not affect availability and requires user interaction (UI:R).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of an official fix, users should restrict subtitle upload permissions to trusted users and consider implementing input validation or output encoding on subtitle filenames to prevent script injection.