A stored cross‑site scripting vulnerability exists in the subtitle deletion flow of GazellePW (GazellePosterWall). An authenticated user can upload a subtitle file with a crafted filename that contains arbitrary JavaScript. The filename is stored on disk during upload and later rendered without proper escaping when the delete action is accessed, causing the script to execute in the victim’s browser. This flaw can lead to session hijacking, data theft, defacement, or further lateral movement, all performed in the context of the victim’s authenticated session.

GazellePW (GazellePosterWall) is affected. The vulnerability is present in all releases up to and including the commit identified as 86c4bedf727691b5a97af42a4864869d18446449. No newer release information is available, so any deployment prior to that commit is potentially vulnerable.

The CVSS score is 5.4, the EPSS score is < 1%, and the impact is significant because the flaw is a stored XSS that requires only an authenticated user to inject malicious code. Once an attacker uploads a subtitle with a malicious filename, any user who visits the deletion page will have the code executed. The attack vector is remote and authenticated, meaning it is exploitable by any account with the privilege to upload subtitles. The vulnerability is not listed in CISA KEV, and no official patch is yet available; therefore, the risk remains high until mitigated.