tatoeba2 Profile Name cross site scripting
Description
A vulnerability was found in tatoeba2. It has been classified as problematic. This affects an unknown part of the component Profile Name Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version prod_2022-10-30 is able to address this issue. The name of the patch is 91110777fc8ddf1b4a2cf4e66e67db69b9700361. It is recommended to upgrade the affected component. The identifier VDB-216501 was assigned to this vulnerability.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- unspecified/tatoeba2v5Range: n/a
Patches
Vulnerability mechanics
Root cause
"Missing HTML sanitization on the profile name field allows stored cross-site scripting."
Attack vector
An attacker can inject arbitrary HTML or JavaScript into the profile name field via the user profile edit page at `/user/edit_profile` [ref_id=1]. When another user visits the attacker's profile, the injected script executes in the victim's browser context, enabling cross-site scripting (XSS) attacks that could lead to session hijacking or account takeover [ref_id=1]. The attack is remote and requires no special privileges beyond a logged-in account to edit one's own profile name.
Affected code
The vulnerability is in the Profile Name Handler component of tatoeba2, which does not sanitize user-supplied HTML in the profile name field [ref_id=1]. The patch also addresses a related unsanitized output issue in private message titles across multiple view files, applying `h()` (HTML-encoding) to `$title`, `$messageTitle`, and `$message->title` [ref_id=2].
What the fix does
The patch wraps previously unsanitized output with CakePHP's `h()` function (which HTML-encodes special characters) in three locations: the private message notification email template, the inbox listing, and the message detail view [ref_id=2]. This ensures that any HTML or JavaScript in user-supplied title text is rendered as safe text rather than executed by the browser. The fix was included in version prod_2022-10-30 [ref_id=1].
Preconditions
- authAttacker must have a logged-in account on the tatoeba2 instance
- inputVictim must visit the attacker's profile page
Reproduction
1. Log in to a tatoeba2 instance and navigate to `https://dev.tatoeba.org/user/edit_profile`. 2. In the "Name" field, enter `<script>alert("hello")</script>` (or any HTML/JavaScript payload) and save. 3. Visit the attacker's profile page — the injected HTML/script will execute in the viewer's browser [ref_id=1].
Generated on May 26, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
4News mentions
0No linked articles in our index yet.