CVE-2022-26980: 
PHP vulnerability analysis and mitigation

Teampass 2.1.26 contains a reflected Cross-Site Scripting (XSS) vulnerability that allows attackers to execute arbitrary JavaScript code via the index.php PATH_INFO parameter. The vulnerability was discovered by Raspina Net Pars Group (RNPG) and assigned CVE-2022-26980 (MITRE CVE, GitHub POC).

The vulnerability exists in the index.php file of Teampass version 2.1.26, where user input from the PATH_INFO parameter is not properly sanitized before being reflected back to the user's browser. This allows attackers to inject malicious JavaScript code that will be executed in the victim's browser context. A proof of concept demonstrates successful exploitation using a payload like http:///?"'>alert('rnpg')" (GitHub POC).

When successfully exploited, this vulnerability allows attackers to execute arbitrary JavaScript code in the context of other users' browsers who visit the specially crafted URL. This could lead to theft of session cookies, credentials, or other sensitive information, as well as potential manipulation of the application's interface and functionality (GitHub POC).

Users should upgrade to a version newer than Teampass 2.1.26. The vulnerability has been addressed in subsequent releases as indicated by the project's commit history (TeamPass Commits).