A Stored XSS vulnerability in the torrent remaster custom title feature in GazellePW (GazellePosterWall) commit… (CVE-2026-38466)

CVE-2026-38466 describes a stored XSS vulnerability in GazellePW's torrent remaster custom title feature. The flaw allows authenticated users to inject JavaScript through the remaster_custom_title parameter, which is stored and later rendered in the torrent title output. This can lead to cross-site scripting attacks impacting confidentiality and integrity but does not affect availability. No patch or remediation details are provided in the available data.

Successful exploitation allows an authenticated user to execute arbitrary JavaScript in the context of other users viewing the affected torrent titles. This can lead to information disclosure and integrity issues such as session hijacking or unauthorized actions performed on behalf of users. There is no indication of availability impact or known active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of an official fix, users should restrict access to trusted authenticated users and consider input validation or sanitization workarounds if possible. Monitor vendor channels for updates and apply official patches once available.