CVE-2026-110103

Medium

Description

bbs-go through 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML or SVG files by spoofing the multipart Content-Type in POST /api/upload. Attackers can upload script-bearing documents served inline from /res and send their URLs to administrators, executing script on the forum's origin.

SeverityMedium

CVSS5.4

Exploit probability—

ProductMlogclub Bbs-go

PublishedOct 13, 2026

First seenOct 13, 2026

Weakness typeCWE-79Cross-site scripting (XSS)

How to fix

Patches

github.com/mlogclub/bbs-go/pull/306
github.com/mlogclub/bbs-go/commit/5bebf98bb9e0ac5162d4f8faf7a65fc0d496a362

Affected products

Product	Affected versions	Fixed in
mlogclub bbs-go	v ≤ 4.4.6	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.