CVE-2026-43938

Description:
Stored (second-order) Cross-Site Scripting (XSS) occurs when attacker-controlled input is persisted through one component of an application and later rendered, without proper sanitization or contextual output encoding, by a completely different component, often one that implicitly trusts the stored data. Because the dangerous sink is typically a privileged administrative interface, the payload executes in the browser of a high-value user (such as an administrator) and inherits their authenticated session. This class of issue is especially severe when the entry point is an HTTP header on an unauthenticated endpoint, since the attack surface extends to any anonymous attacker on the internet with no prerequisites.

Issue Details:
The application's database logger (YAFNET.Core/Logger/DbLogger.cs) captures the incoming request's User-Agent header into a JObject, serializes it with JsonConvert, and stores the result in the EventLog.Description column whenever an event (e.g., an unhandled exception) is logged. The admin event-log page (YetAnotherForum.NET/Pages/Admin/EventLog.cshtml.cs) later deserializes that JSON in FormatStackTrace() and interpolates the UserAgent value directly into an HTML string with no encoding, and the Razor view EventLog.cshtml emits the result through @Html.Raw. Critically, the attacker does not need to be authenticated: the unauthenticated endpoint GET /api/Attachments/GetAttachment?attachmentId=2147483647 reliably triggers a server-side exception that is written to dbo.EventLog together with the attacker-controlled User-Agent. A single anonymous request such as curl -A "<img src=x onerror=alert('XSS')>" "http://<target>/api/Attachments/GetAttachment?attachmentId=2147483647" is sufficient to persist the payload, and when an administrator later visits /Admin/EventLog the malicious markup is rendered as live HTML in the admin's authenticated session.

Impact:
An entirely unauthenticated attacker, with no account, no CSRF token, and no prior access, can stage JavaScript that will execute in an administrator's browser the next time the Event Log is viewed. Because the script runs in the admin's authenticated origin, it can perform any action the admin can: creating new administrative accounts, modifying site-wide settings, exfiltrating user data through admin-only endpoints. This effectively converts a single anonymous HTTP request into a full forum-takeover primitive, and the lack of any authentication requirement makes it exploitable at internet scale, including by automated scanners.

Likelihood:
Exploitation requires only the ability to send a single HTTP request to a public, unauthenticated endpoint, which any anonymous attacker on the internet can do. Administrators routinely review the Event Log as part of normal operations, so payload delivery is highly probable with negligible attacker effort, making the overall likelihood very high.

Steps to Reproduce:

• From an unauthenticated session (no cookies, no tokens), send the following request with a malicious User-Agent header:
  • curl.exe -sS -A "<img src=x onerror=alert('XSS')>" "http://yetanotherforum.internal:8080/api/Attachments/GetAttachment?attachmentId=2147483647"
• Confirm the server returns an error response and that a row has been written to dbo.EventLog containing the attacker-controlled UserAgent value inside the JSON Description.
• As an administrator (e.g., Superuser), navigate to /Admin/EventLog.
• Observe that the rendered page contains the raw <img src=x onerror="alert('XSS')"> element inside the event's badge block, and that the onerror handler executes in the admin's authenticated session, confirming cross-session, cross-privilege script execution from an unauthenticated source.

Untrusted input is rendered as active markup in a victim's browser, which can run script in their session. Typical impact: session or credential theft, and actions taken as the user.

CVE-2026-43938 has a CVSS score of 8.1 (High). The vector is network-reachable, no privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (4.0.5, 3.2.12); upgrading removes the vulnerable code path.

Kodem intelligence

1. What is CVE-2026-43938? CVE-2026-43938 is a high-severity cross-site scripting (XSS) vulnerability in YAFNET.Core (nuget), affecting versions >= 4.0.0-beta01, <= 4.0.4. It is fixed in 4.0.5, 3.2.12. Untrusted input is rendered as active markup in a victim's browser, which can run script in their session.
2. How severe is CVE-2026-43938? CVE-2026-43938 has a CVSS score of 8.1 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of YAFNET.Core are affected by CVE-2026-43938? YAFNET.Core (nuget) versions >= 4.0.0-beta01, <= 4.0.4 is affected.
4. Is there a fix for CVE-2026-43938? Yes. CVE-2026-43938 is fixed in 4.0.5, 3.2.12. Upgrade to this version or later.
5. Is CVE-2026-43938 exploitable, and should I be worried? Whether CVE-2026-43938 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2026-43938 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2026-43938?
   • Upgrade YAFNET.Core to 4.0.5 or later
   • Upgrade YAFNET.Core to 3.2.12 or later