Platform
java
Component
pybbs
Fixed in
6.0.1
CVE-2026-4494 describes a cross-site scripting (XSS) vulnerability discovered in atjiu pybbs version 6.0.0. This flaw allows attackers to inject malicious scripts into the application, potentially compromising user sessions and data. The vulnerability affects versions 6.0.0 through 6.0.0 and is exploitable remotely. A fix is available.
Successful exploitation of CVE-2026-4494 allows an attacker to execute arbitrary JavaScript code within the context of a user's browser session. This can lead to various malicious actions, including session hijacking, credential theft, and defacement of the application's user interface. The attacker could potentially steal sensitive information displayed on the page or redirect users to malicious websites. Given the remote accessibility of the vulnerability, the blast radius extends to all users interacting with the affected pybbs instance.
A public proof-of-concept (PoC) for CVE-2026-4494 is available, indicating a relatively high likelihood of exploitation. The vulnerability was publicly disclosed on 2026-03-20. The CVSS score is LOW, suggesting the exploit requires specific conditions or user interaction to be successful, but the availability of a PoC increases the risk. No KEV listing or confirmed exploitation campaigns have been reported as of this date.
Exploit Status
EPSS
0.03% (8% percentile)
CISA SSVC
The primary mitigation for CVE-2026-4494 is to upgrade to a patched version of atjiu pybbs. Until a patched version is available, consider implementing input validation and output encoding on the TopicApiController.java create function to sanitize user-supplied data. Web application firewalls (WAFs) configured with rules to detect and block XSS payloads can also provide a temporary layer of protection. After upgrading, confirm the vulnerability is resolved by attempting to inject a simple XSS payload through the create function and verifying that it is properly sanitized.
Update pybbs to a version later than 6.0.0. This will fix the Cross-Site Scripting (XSS) vulnerability in the create function of the TopicApiController.java file.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-4494 is a cross-site scripting (XSS) vulnerability affecting atjiu pybbs version 6.0.0, allowing attackers to inject malicious scripts via the create function.
If you are using atjiu pybbs version 6.0.0, you are potentially affected by this vulnerability. Upgrade to a patched version as soon as possible.
The recommended fix is to upgrade to a patched version of atjiu pybbs. Until a patch is available, implement input validation and output encoding.
A public proof-of-concept exists, suggesting a potential for active exploitation. Monitor your systems for suspicious activity.
Refer to the atjiu pybbs project's official website or GitHub repository for the latest security advisories and updates.
CVSS Vector
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your pom.xml file and we'll tell you instantly if you're affected.