CVE-2026-110103: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in mlogclub bbs-go

The vulnerability in bbs-go versions up to 4.4.6 allows authenticated users to bypass input validation by spoofing the multipart Content-Type in POST requests to /api/upload. This enables them to upload HTML or SVG files containing malicious scripts. Since these files are served inline from the /res directory, an attacker can send the URLs to forum administrators, causing script execution within the forum's origin context. This is a stored cross-site scripting vulnerability that can lead to script execution without requiring user interaction beyond visiting the malicious URL.

Successful exploitation allows an authenticated user to execute arbitrary scripts in the context of the forum's origin when administrators or other privileged users access the maliciously uploaded files. This can lead to session hijacking, privilege escalation, or other attacks that rely on script execution within the trusted domain. The CVSS 4.0 score is 5.1 (medium severity), reflecting the need for authentication and user interaction but the potential impact on administrative users.

No official patch or remediation guidance is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict upload permissions to trusted users only and avoid accessing suspicious uploaded files. Consider implementing additional input validation or filtering on uploaded content to prevent HTML or SVG files from being accepted or served inline.