bbs-go EUVD-2026-98936

Exploitation requires (1) an authenticated low-privilege account on the bbs-go instance (PR:L) capable of calling POST /api/upload; (2) the attacker forging the multipart Content-Type header to disguise an HTML or SVG file as an image, defeating the pre-patch client-declared type check; and (3) a victim administrator being socially engineered into opening the resulting /res URL (UI:P) so the stored script executes in their session on the forum origin. Limiting factors: no anonymous/unauthenticated path, the payload only fires when a higher-privilege user visits the inline-served file, and instances on versions after 4.4.6 (which sniff real content type via http.DetectContentType and reject SVG) are not affected.

This is a genuine but moderate-severity issue, correctly rated Medium (CVSS 4.0 base 5.1). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N) is internally consistent with the description: network-reachable, low attack complexity, but requires an authenticated low-privilege account (PR:L) AND passive victim interaction (UI:P) - an administrator must open an attacker-supplied /res URL. The absence of any direct confidentiality/integrity/availability impact on the vulnerable system (VC/VI/VA:N) with only subsequent-system impact (SC:L/SI:L) reflects a classic stored-XSS escalation path rather than a server compromise. No EPSS score, CISA KEV listing, or public exploit code was provided in the intelligence; this is therefore not a confirmed high-urgency item. A patch is confirmed to exist (commit 5bebf98 and the vendor's VulnCheck advisory), which raises priority for exposed instances that remain unpatched, but the dual requirement of a valid account plus admin interaction limits mass automated exploitation. Net: a real vulnerability worth patching, not an emergency - prioritize behind network-vector, unauthenticated, actively-exploited issues.

An attacker with an ordinary authenticated forum account uploads a malicious .html or .svg file to POST /api/upload while spoofing the multipart Content-Type to appear as an image, bypassing the client-declared type check. The file is stored and served inline from /res, so the attacker then messages or otherwise lures a forum administrator into opening the URL, executing attacker-controlled JavaScript in the admin's browser on the forum's origin. No public exploit code was identified, but the fixing commit and detailed advisory make the technique reproducible.