CVE-2026-27020

Vulnerability

Overview

Photobooth prior to version 1.0.1 contains a cross-site scripting (XSS) vulnerability in its user input fields. The root cause is the lack of input validation and sanitization, allowing malicious users to inject arbitrary scripts through form inputs [1].

Exploitation

An attacker can exploit this vulnerability by submitting crafted payloads through any user-facing input field in the Photobooth application. No authentication is required if the input fields are publicly accessible, though the exact attack surface depends on the deployment configuration. The injected script executes in the context of other users' browsers when they view the affected content [1].

Impact

Successful exploitation enables an attacker to execute arbitrary JavaScript in the context of the victim's session. This can lead to session hijacking, data theft, defacement, or redirection to malicious sites. The impact is consistent with typical stored XSS attacks [1].

Mitigation

The vulnerability is fixed in Photobooth version 1.0.1, which adds proper input sanitization. Users are advised to upgrade immediately. As a workaround, administrators can manually sanitize all user inputs before rendering, but upgrading is the recommended solution [1].