High
YAF.NET: Stored XSS in Forum Thread Posts/Replies Allowing Arbitrary JavaScript Execution for All Thread Viewers
Type: advisorySources: OSV
YetAnotherForum.NET (YAF.NET) is a C# ASP.NET forum. Prior to 4.0.5 and 3.2.12, the thread posting and reply feature accepts user-supplied content via a a post or reply that is stored server-side and later rendered back into the thread page without adequate HTML sanitization or contextual output encoding. This vulnerability is fixed in 4.0.5 and 3.2.12.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-43939
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 8 Nov 2026, 03:26 UTC · Revision 1
Source evidence
YAF.NET: Stored XSS in Forum Thread Posts/Replies Allowing Arbitrary JavaScript Execution for All Thread Viewers
core-osv · Original sourcePublished 12 May 2026, 13:56 UTC
YetAnotherForum.NET (YAF.NET) is a C# ASP.NET forum. Prior to 4.0.5 and 3.2.12, the thread posting and reply feature accepts user-supplied content via a a post or reply that is stored server-side and later rendered back into the thread page without adequate HTML sanitization or contextual output encoding. This vulnerability is fixed in 4.0.5 and 3.2.12.
osv:CVE-2026-43939
Complete source record
{
"id": "ffbb92d170e959634ca332e83ce68f556b00a74fcd21aa5e95579fc4a944ba1e",
"url": "https://osv.dev/vulnerability/CVE-2026-43939",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "YAF.NET: Stored XSS in Forum Thread Posts/Replies Allowing Arbitrary JavaScript Execution for All Thread Viewers",
"summary": "YetAnotherForum.NET (YAF.NET) is a C# ASP.NET forum. Prior to 4.0.5 and 3.2.12, the thread posting and reply feature accepts user-supplied content via a a post or reply that is stored server-side and later rendered back into the thread page without adequate HTML sanitization or contextual output encoding. This vulnerability is fixed in 4.0.5 and 3.2.12.",
"evidence": "osv:CVE-2026-43939",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2026-43939",
"aliases": [
"CVE-2026-43939",
"GHSA-8rq5-wwpp-fmj2"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/yafnet/yafnet",
"type": "GIT",
"events": [
{
"introduced": "c2932f06fe41f11e723879f8febf3e96b91d5750"
},
{
"fixed": "3cb0ee7fbc01f8d3e84eaddf55350aced2dd4bfc"
},
{
"introduced": "0"
},
{
"fixed": "28579da80af507294dbdf9ae5b44ad9c185d0720"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "4.0.0-beta.1"
},
{
"fixed": "4.0.5"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"introduced": "0"
},
{
"fixed": "3.2.12"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
}
]
}
}
],
"versions": [
"v3.2.11",
"v4.0.4",
"v4.0.3",
"v4.0.2",
"v3.2.10",
"v3.2.9",
"v4.0.1",
"v3.2.8",
"v4.0.0",
"v4.0.0-rc.4",
"v3.2.7",
"v3.2.6",
"v4.0.0-rc.3",
"v4.0.0-rc.2",
"v4.0.0-rc.1",
"v3.2.5",
"v3.2.4",
"v4.0.0-beta.7",
"v3.2.3",
"v4.0.0-beta.3",
"v4.0.0-beta.1",
"v3.2.2",
"v3.2.1",
"v3.2.0",
"v3.1.15",
"v3.1.14",
"v3.1.13",
"v3.1.12",
"v3.1.11",
"v3.1.10",
"v3.1.9",
"v3.1.8",
"v3.1.7",
"v3.1.6",
"v3.1.5",
"v3.1.4",
"v3.1.3",
"v3.1.2",
"v3.1.1",
"v3.1.0",
"v3.0.2",
"v2.3.1.0",
"v2.3.0.5-beta.1",
"v2.3.0.4",
"v2.3.0.4-beta.1",
"v2.3.0.0",
"v2.3.0.0-rc.5",
"v2.3.0.0-rc.4",
"v2.3.0.0-rc.3",
"v2.3.0.0-rc.2",
"v2.3.0.0-rc.1",
"v2.3.0.0-beta.4",
"v2.3.0.0-beta.3",
"v2.3.0.0-beta.2",
"v2.3.0.0-BETA1",
"v2.2.4.19",
"v2.2.4.18",
"v2.2.4.10",
"v2.2.4.9",
"v2.2.4.8",
"v2.2.4.7",
"v2.2.4.6",
"v2.2.4.5",
"v2.2.4.4",
"v2.2.4.3",
"v2.2.4.2",
"v2.2.4.1",
"v2.2.4.0",
"v2.2.4.0-nightly",
"v2.2.3",
"v2.2.3.0-nightly.118",
"v2.2.3.0-nightly.115",
"v2.2.2",
"v2.2.2.0-nightly.76",
"v2.2.1",
"v2.2.1.0-nightly.20",
"v2.2.0",
"v2.2.0-rc.1",
"v2.2.0-beta.1",
"v2.1.2-beta.1",
"v2.1.2",
"v2.1",
"v2.0.0",
"release_2_0_0_RC1",
"release_1_9_6_1_RTW",
"release_1_9_6_FINAL",
"release_1_9_6_RC1",
"release_1_9_6_BETA1",
"release_1_9_5_5_RTW",
"release_1_9_5_5_BETA",
"release_1_9_5_RC1",
"release_1_9_4_FINAL",
"release_1_9_4_BETA",
"release_1_0_2",
"aspnet20a",
"complete2",
"complete",
"release_0_9_9b",
"release_0_9_9",
"yaf_dnn2",
"release_0_9_8B",
"release_0_9_8",
"release_0_9_7",
"release_0_9_6",
"release_0_9_5",
"release_0_9_4",
"release_0_9_3",
"release_0_9_2",
"release_0_9_1",
"release_0_9_0",
"release_0_8_2",
"release_0_8_1",
"start"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-43939.json"
}
}
],
"modified": "2026-10-28T02:30:53.140204367Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43939.json",
"https://github.com/YAFNET/YAFNET/security/advisories/GHSA-8rq5-wwpp-fmj2",
"https://nvd.nist.gov/vuln/detail/CVE-2026-43939"
],
"provider_metadata": {
"cwe_ids": [
"CWE-116",
"CWE-79",
"CWE-80"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43939.json"
}
},
"related_cves": [
{
"value": "CVE-2026-43939",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 522194,
"published_at": "2026-05-12T13:56:39.586+00:00"
}