CVE-2026-38473: n/a

This vulnerability allows remote authenticated users to perform stored XSS attacks by injecting malicious JavaScript code through a crafted subtitle filename during upload. The injected script is stored and later rendered in the /subtitles.php?action=delete endpoint, enabling script execution in the context of the victim's browser. The vulnerability arises from insufficient sanitization or encoding of the subtitle filename before rendering. No patch or official remediation information is currently available.

Successful exploitation can lead to limited confidentiality and integrity impacts by executing arbitrary JavaScript in the context of the affected application for authenticated users. This could allow attackers to perform actions such as session hijacking or unauthorized actions within the scope of the authenticated user. There is no impact on availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to restrict subtitle filename inputs to safe characters and implement proper output encoding or sanitization on the subtitle deletion page to prevent script execution. Monitoring for suspicious activity related to subtitle uploads and deletion actions may also help detect exploitation attempts.