CVE-2024-47826 eLabFTW vulnerable to HTML Injection in extended search error message
Attackers can inject HTML into error messages in eLabFTW, potentially altering page display, though JavaScript execution is blocked.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-47826?
CVE-2024-47826 is a low-severity cross-site scripting vulnerability in elabftw, published on 14 Oct 2024. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
eLabFTW is an open source electronic lab notebook for research labs. A vulnerability in versions prior to 5.1.5 allows an attacker to inject arbitrary HTML tags in the pages: "experiments.php" (show mode), "database.php" (show mode) or "search.php". It works by providing HTML code in the extended search string, which will then be displayed back to the user in the error message. This means that injected HTML will appear in a red "alert/danger" box, and be part of an error message. Due to some other security measures, it is not possible to execute arbitrary javascript from this attack. As such, this attack is deemed low impact. Users should upgrade to at least version 5.1.5 to receive a patch. No known workarounds are available.
Which versions are affected by CVE-2024-47826?
It affects 1 product.
Products include Elabftw Elabftw.
How do I fix CVE-2024-47826?
No fix has been published for CVE-2024-47826 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-47826 being exploited?
There is no known exploitation of CVE-2024-47826 in the wild and no public exploit code.
Other vulnerabilities in elabftw
- CVE-2021-43834 Incorrect Authentication in elabftw
- CVE-2024-28100 Stored Cross-site Scripting leading to arbitrary actions taken on behalf of users in elabftw
- CVE-2019-12185 File upload in n/a
- CVE-2024-25632 Unauthorised granting of administrator privileges over arbitrary teams under certain circumstances
- CVE-2025-25206 Incorrect input validation could allow an authenticated user to read sensitive information
Sources
Also known as GHSA-cjww-pr9f-4c4w.