Stored XSS via SVG Upload — check_content() Blocklist Bypass & 256-Byte Scan Limit (Self-Propagating Worm)

Bug reported by Ammar Y. Sami was disclosed at July 30, 2026, 8:29 pm   |   Cross-site Scripting (XSS) - Stored

A stored XSS vulnerability was discovered in phpBB 4.0.0-a2-dev. The vulnerability was caused by an incomplete blocklist for file uploads and a 256-byte read limit in the content scanning check. Specifically, SVG files with malicious payloads in the onload and onbegin attributes were able to bypass the content check and be stored on the server. Additionally, any content beyond the 256-byte limit was not scanned, allowing payloads like <script> tags to be successfully uploaded. The uploaded SVG files were served with inline content disposition, causing the browser to render and execute the embedded JavaScript when the attachment link was clicked.

Permission Model bypass: process.report writes (and overwrites) files outside --allow-fs-write paths

Bug reported by Sinan Polat was disclosed at July 30, 2026, 3:07 pm   |   Improper Access Control - Generic

A flaw was found in the Node.js Permission Model enforcement that allowed the process.report function to write (and overwrite) files outside the --allow-fs-write paths.

HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026-48934)

Bug reported by vnyuh was disclosed at July 30, 2026, 2:09 am   |   Exploiting Incorrectly Configured SSL/TLS

A vulnerability was identified in Node.js where HTTPS Agent TLS session reuse skipped hostname verification across identity policies, which was an incomplete fix for CVE-2026-48934. This affected Node.js versions 22.x, 24.x, and 26.x.