CVE-2026-23840
📋 TL;DR
This cross-site scripting (XSS) vulnerability in Movary allows attackers to inject malicious scripts via the 'categoryDeleted' parameter. Users of Movary versions prior to 0.70.0 are affected, potentially enabling session hijacking or credential theft.
💻 Affected Systems
- Movary
📦 What is this software?
Movary by Leepeuker
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal user sessions, compromise admin accounts, deface the application, or redirect users to malicious sites.
Likely Case
Attackers steal user authentication cookies or session tokens, leading to account takeover.
If Mitigated
Limited impact with proper content security policies and input validation, though XSS could still execute in user context.
🎯 Exploit Status
XSS vulnerabilities are commonly exploited; no public proof-of-concept identified but trivial to craft.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.70.0
Vendor Advisory: https://github.com/leepeuker/movary/security/advisories/GHSA-pj3m-gmq8-2r57
Restart Required: Yes
Instructions:
1. Backup your Movary installation and database. 2. Download version 0.70.0 from GitHub releases. 3. Replace existing files with new version. 4. Restart the web server.
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side validation to sanitize the 'categoryDeleted' parameter.
Modify server-side code to escape HTML entities in user input.
Content Security Policy
allImplement CSP headers to restrict script execution sources.
Add 'Content-Security-Policy' header with script-src directives.
🧯 If You Can't Patch
- Deploy a web application firewall (WAF) with XSS protection rules.
- Isolate Movary instance behind reverse proxy with input sanitization.
🔍 How to Verify
Check if Vulnerable:
Check if Movary version is below 0.70.0 via admin interface or version file.Check Version:
Check 'composer.json' or version file in Movary installation directory.Verify Fix Applied:
Test the 'categoryDeleted' parameter with XSS payloads; no script execution should occur.📡 Detection & Monitoring
Log Indicators:
- HTTP requests with 'categoryDeleted' parameter containing script tags or JavaScript.
Network Indicators:
- Unusual outbound connections from Movary server post-XSS execution.
SIEM Query:
web.url:*categoryDeleted=* AND (web.url:*<script* OR web.url:*javascript:*)