CVE-2024-26495
Description
Stored XSS in Friendica post content via BBCode tags allows remote attackers to execute arbitrary JavaScript when users hover over crafted links.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Stored XSS in Friendica post content via BBCode tags allows remote attackers to execute arbitrary JavaScript when users hover over crafted links.
Vulnerability
A stored cross-site scripting (XSS) vulnerability exists in Friendica versions after v.2023.12, where posts and comments can contain malicious BBCode tags that are not properly sanitized. Specifically, the [url] tag allows injection of event handlers (e.g., onmouseover) inside the URL attribute, leading to script execution when a user interacts with the link [1]. Affected versions: all Friendica releases after 2023.12 up to (and not including) the fix version (if one exists).
Exploitation
An attacker must have a valid user account on the Friendica instance and be able to create posts or comments. The attacker crafts a post with a specially formed BBCode URL tag, such as [url=http://www.example.com" onmouseover="alert('XSS')]text[/url]. When any user (including the attacker) hovers the mouse over the rendered link, the injected JavaScript executes in the context of the victim's browser [1]. No additional privileges or user interaction beyond visiting the page and hovering is required.
Impact
Successful exploitation allows an attacker to execute arbitrary JavaScript in the browsers of users who view the malicious post. This can lead to session hijacking, data theft, or actions performed on behalf of the victim. Since posts are stored, the XSS persists and affects all users who read the post, potentially compromising the entire application's data and functionality [1].
Mitigation
As of the publication date (2024-04-03), no official patched version has been released by Friendica. The issue is tracked in the project's GitHub issue tracker [1]. Users are advised to disable BBCode rendering or apply input sanitization as a workaround until a fix is provided. The CVE is not listed in CISA's Known Exploited Vulnerabilities catalog.
AI Insight generated on May 25, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
2Patches
0No patches discovered yet.
Vulnerability mechanics
Root cause
"Missing sanitization of BBCode URL attributes allows injection of arbitrary HTML event handlers into rendered post content."
Attack vector
An authenticated attacker creates a post (or comment) containing a crafted BBCode `[url]` tag where the URL attribute includes a double-quote followed by an event handler, e.g. `[url=http://www.example.com" onmouseover="alert('XSS')]text[/url]` [ref_id=1]. When any user views the post and hovers over the link, the injected `onmouseover` handler executes arbitrary JavaScript in the context of the victim's session [ref_id=1]. The payload is stored server-side and triggers for every reader, making this a stored (persistent) XSS attack [ref_id=1].
Affected code
The advisory [ref_id=1] does not specify exact file paths or function names. The vulnerability lies in the BBCode parsing and HTML rendering logic that processes `[url]` tags in post content and comments. The issue was reproduced on Friendica version 2023.12 [ref_id=1].
What the fix does
No patch is included in the bundle. The advisory [ref_id=1] reports that a similar BBCode injection was previously fixed but a bypass remains possible, and the issue was filed with the Friendica team for remediation. Until a fix is applied, the application does not properly neutralize the URL attribute inside `[url]` BBCode tags before rendering the HTML, allowing event handler injection [ref_id=1].
Preconditions
- authAttacker must be authenticated to create posts or comments.
- inputAttacker must supply a crafted BBCode [url] tag with an injected HTML event handler in the URL attribute.
Reproduction
1. Log in to Friendica. 2. Create a new post with the body: `[url=http://www.example.com" onmouseover="alert('XSS')]text[/url]`. 3. Share the post. 4. Hover the mouse over the link in the post. 5. Observe the XSS payload trigger [ref_id=1].
Generated on May 26, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
1News mentions
0No linked articles in our index yet.