PT-2026-33300 · Wger · Wger

Published 2026-04-16 · Updated 2026-04-18 · CVE-2026-40353

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions wger versions prior to 2.5

Description The attribution link property in AbstractLicenseModel constructs HTML by directly interpolating user-controlled license fields without escaping. These fields include license author, license title, license object url, license author url, and license derivative source url. Because templates render the result using the Django |safe filter, which disables auto-escaping, an authenticated user can inject malicious JavaScript into the license author field. This results in stored Cross-Site Scripting (XSS), where the script executes in the browser of any visitor viewing the affected ingredient page. The issue is reachable via the '/en/nutrition/ingredient/add/' endpoint.

Recommendations Update to version 2.5 or newer. As a temporary workaround, restrict access to the license author field in the ingredient creation form to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-40353

GHSA-6F54-QJVM-WWQ3

Affected Products

Wger

References · 7

• 🔥 https://github.com/wger-project/wger/security/advisories/GHSA-6f54-qjvm-wwq3 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-40353 · Security Note
• https://osv.dev/vulnerability/GHSA-6f54-qjvm-wwq3 · Vendor Advisory
• https://github.com/wger-project/wger · Note
• https://github.com/wger-project/wger/releases/tag/2.5 · Note
• https://twitter.com/VulmonFeeds/status/2045386037405405336 · Twitter Post
• https://twitter.com/CVEnew/status/2045467379182776630 · Twitter Post