PT-2026-2171 · Gestsup · Gestsup

Geoffrey Robert + 2 · Published 2026-01-09 · Updated 2026-01-09 · CVE-2026-22198

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions GestSup versions up to and including 3.2.56

Description GestSup versions up to and including 3.2.56 contain a pre-authentication stored cross-site scripting (XSS) issue in the API error logging functionality. An unauthenticated attacker can inject attacker-controlled HTML/JavaScript into log entries by sending a crafted API request with a malicious X-API-KEY header value to the /api/v1/ticket.php endpoint. When an administrator views the affected logs in the web interface, the injected content is rendered without proper output encoding, leading to arbitrary script execution in the administrator’s browser session.

Recommendations GestSup versions prior to 3.2.56 should be updated.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-22198

Affected Products

Gestsup

References · 6

• https://osv.dev/vulnerability/CVE-2026-22198 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22198 · Security Note
• https://twitter.com/CVEnew/status/2009670028912681064 · Twitter Post
• https://vulncheck.com/advisories/gestsup-stored-xss-in-api-error-logs · Note
• https://gestsup.fr/index.php?page=changelog · Note
• https://t.me/CVEtracker/41869 · Telegram Post