CVE-2026-42197: RELATE Vulnerable to Stored XSS via Unprivileged User Profile

Synopsis

Stored cross-site scripting (XSS) in RELATE, a web-based courseware package, allows any enrolled student to inject arbitrary JavaScript into an administrator's browser session. The vulnerability is reachable over the network and requires only a low-privilege account (any enrolled student); an administrator must subsequently view the affected Participation list page in the Django admin panel for the payload to execute. Successful exploitation gives the attacker full control over the admin's browser session, enabling account takeover with admin-level privileges. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published as a versioned release.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable Django admin endpoint is exposed over the network, so the attacker must be able to reach the RELATE web service and the triggering admin must load the Participation list page via a browser over the same network.

• AuthenticationRequired

  The attacker must hold a valid enrolled-student account; any low-privilege authenticated user is sufficient to write the malicious payload via the profile page at /profile/.

• Victim interactionRequired

  An administrator must navigate to the Participation list in the Django admin panel after the payload has been stored, providing the social-engineering surface where a student waits for routine admin activity.

• Attack complexityDetail

  Attack complexity is low: the exploit is reliable and condition-free once the payload is stored, requiring no race conditions, memory layout knowledge, or special environmental configuration.

Blast Radius

• The attacker's JavaScript executes in the administrator's browser session, reading the admin's session cookies and CSRF tokens directly.
• With those credentials the attacker can authenticate as the admin, accessing all course data, student records, and system configuration in RELATE.
• The attacker can modify persisted data in the admin panel, including grades, enrollments, and course content, under the admin's identity.
• The admin account can be fully taken over by changing credentials or installing further payloads, since the JavaScript runs with the same privileges as any admin-initiated action.