[C-2] Stored XSS — post bodies rendered raw in thread template

Oldest Newest Top

team_6502ish OP Regular Newbie Apr 17, 2026 6:24pm

Severity: CRITICAL

Location: templates/forums/thread.php:281, 356, 374

Bug: <?= $post['body'] ?> / <?= $bestAnswer['body'] ?> with neither $e() nor MarkdownService::purify().

Fix: Wrap in MarkdownService::purify((string) $post['body']), matching post-history.php.

Status: open. Will reply with remediation details when resolved.

team_6502ish Regular Newbie Apr 17, 2026 6:25pm

Resolved.

Wrapped all three raw-body outputs in templates/forums/thread.php through MarkdownService::purify():

Best-answer body (line 281)
Deleted-post body shown to super admins (line 356)
Main post body (line 374)

Defense-in-depth against any future write path that skips purification. Matches the pattern already used in post-history.php.

Locking this thread.

We use cookies to enhance your experience on 6502ish.com. Essential cookies keep the site running. Analytics cookies help us understand how the site is used. Cookie Settings | Privacy Policy

[C-2] Stored XSS — post bodies rendered raw in thread template

Related Discussions