{"id":"CVE-2026-116212","kind":"vulnerability","aliases":["CVE-2026-116212"],"related":[],"title":"Webasyst Photos app: stored XSS in album URL field","description":"Webasyst Framework through 4.4.0 contains a stored cross-site scripting vulnerability in the Photos app that allows authenticated backend users to inject JavaScript via the album url parameter. Attackers with album edit rights can save a url value that breaks out of the unescaped attribute in DialogAlbumSettings.html, executing JavaScript in administrators' backend sessions.","summary":"Webasyst Framework through 4.4.0 has a stored cross-site scripting flaw in the Photos app's album settings dialog. A backend user with album edit rights can save a crafted URL that runs JavaScript in administrators' backend sessions.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","php","self-hosted","webasyst"],"not_affected_if":["only-trusted-backend-users","photos-app-not-installed"],"how_to_check":"- Check the installed Webasyst Framework version (unknown how to read it from the sources; look in the Webasyst installation's version file or admin panel)\n- Check whether the Photos app is installed and whether any users have album edit rights","fix":null,"status":"open","published_at":"2026-10-26T14:16:33+00:00","first_seen_at":"2026-10-26T14:30:36+00:00","triaged_at":"2026-10-26T14:32:42+00:00","updated_at":"2026-10-26T14:32:42+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-26T14:32:42Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Webasyst Photos app: stored XSS in album URL field","impact":"medium","summary":"Webasyst Framework through 4.4.0 has a stored cross-site scripting flaw in the Photos app's album settings dialog. A backend user with album edit rights can save a crafted URL that runs JavaScript in administrators' backend sessions.","category":"other","nicknames":[],"who_cares":["webasyst","self-hosted","php"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker's JavaScript runs in administrators' backend sessions","analyst_note":"Find the fixed Webasyst version and patch notes for the Photos app; the NVD entry does not name a fixed release.","how_to_check":"- Check the installed Webasyst Framework version (unknown how to read it from the sources; look in the Webasyst installation's version file or admin panel)\n- Check whether the Photos app is installed and whether any users have album edit rights","needs_analyst":true,"not_affected_if":["photos-app-not-installed","only-trusted-backend-users"],"who_is_affected":"Teams running Webasyst Framework 4.4.0 or earlier with the Photos app installed, where some backend users can edit albums. The sources do not name a fixed version. Installations without the Photos app, or where only trusted users can edit albums, are less exposed.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000592,"input_tokens":3349,"output_tokens":515,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116212':12A,15A '-2026':11A,14A '4.4.0':25B,64C 'administr':58B,112C 'album':7A,39B,46B,87C,92C 'allow':78C 'app':3A,37B,76C 'attack':90C 'attribut':106C 'authent':79C 'backend':43B,59B,80C,113C 'break':101C 'contain':65C 'craft':52B 'cross':30B,69C 'cross-sit':29B,68C 'cve':10A,13A 'dialog':41B 'dialogalbumsettings.html':108C 'edit':47B,93C 'execut':109C 'field':9A 'flaw':33B 'framework':23B,62C 'host':20B 'inject':83C 'javascript':56B,84C,110C 'paramet':89C 'photo':2A,36B,75C 'php':17B 'right':48B,94C 'run':55B 'save':50B,96C 'script':32B,71C 'self':19B 'self-host':18B 'session':60B,114C 'set':40B 'site':31B,70C 'store':4A,28B,67C 'unescap':105C 'url':8A,53B,88C,98C 'user':44B,81C 'valu':99C 'via':85C 'vulner':72C 'webasyst':1A,21B,22B,61C 'xss':5A","nicknames":[],"mitigations":[],"who_affected":"Teams running Webasyst Framework 4.4.0 or earlier with the Photos app installed, where some backend users can edit albums. The sources do not name a fixed version. Installations without the Photos app, or where only trusted users can edit albums, are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T14:16:33+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116212","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116212","severity":null,"published_at":"2026-10-26T14:16:33+00:00","modified_at":"2026-10-26T14:16:33+00:00","first_seen_at":"2026-10-26T14:30:36+00:00","fetched_at":"2026-10-26T14:30:36+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}