CVE-2026-23839
📋 TL;DR
This cross-site scripting vulnerability in Movary allows attackers to inject malicious scripts via the 'categoryUpdated' parameter. Users running Movary versions before 0.70.0 are affected, potentially enabling session hijacking, credential theft, or website defacement.
💻 Affected Systems
- Movary
📦 What is this software?
Movary by Leepeuker
⚠️ Risk & Real-World Impact
Worst Case
Complete account takeover, credential theft, installation of malware on user systems, or complete compromise of the Movary instance.
Likely Case
Session hijacking, credential theft, or website defacement affecting users who visit malicious links.
If Mitigated
Limited impact with proper input validation and output encoding in place.
🎯 Exploit Status
XSS vulnerabilities are commonly weaponized; exploitation requires user interaction with malicious links.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.70.0
Vendor Advisory: https://github.com/leepeuker/movary/security/advisories/GHSA-v32w-5qx7-p3vq
Restart Required: Yes
Instructions:
1. Backup your Movary instance. 2. Update to version 0.70.0 via git pull or download from releases. 3. Restart the web server/service. 4. Verify the update.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side input validation for the 'categoryUpdated' parameter to sanitize or reject malicious input.
Web Application Firewall
allDeploy a WAF with XSS protection rules to block malicious requests.
🧯 If You Can't Patch
- Restrict access to Movary instance to trusted networks only.
- Implement Content Security Policy headers to mitigate XSS impact.
🔍 How to Verify
Check if Vulnerable:
Check if Movary version is below 0.70.0 via web interface or version file.Check Version:
Check composer.json or version file in Movary installation directory.Verify Fix Applied:
Confirm version is 0.70.0 or higher and test 'categoryUpdated' parameter with XSS payloads.📡 Detection & Monitoring
Log Indicators:
- Unusual requests to 'categoryUpdated' parameter with script tags or JavaScript code.
Network Indicators:
- HTTP requests containing malicious scripts in query parameters.
SIEM Query:
http.uri_query contains "categoryUpdated" AND (http.uri_query contains "<script>" OR http.uri_query contains "javascript:")