# Security Advisory: Stored Cross-Site Scripting (XSS) in Nirix Traq v3.9.0 (CVE-2026-37196)

## Overview

A **Stored Cross-Site Scripting (XSS)** vulnerability exists in **Nirix Traq v3.9.0** that allows authenticated attackers to inject malicious JavaScript into the **ticket description field**. The payload is later executed when a privileged user (e.g., administrator) views the affected ticket in the **timeline panel**.

**CVE ID:** CVE-2026-37196
**Affected Product:** Nirix Traq v3.9.0
**Vulnerability Type:** Stored Cross-Site Scripting (XSS)
**Attack Type:** Remote
**Authentication Required:** Yes (Low-privileged user)

## Affected Component

* Ticket Description Field
* Timeline Panel Rendering Component

## Description

The application improperly sanitizes user-controlled input in the ticket description field. An authenticated low-privileged user can inject arbitrary JavaScript payloads, which are stored and later executed in the browser context of higher privileged users when viewing the ticket timeline.

### Proof of Concept

```html id="2kn8jr"
<script>alert(document.domain)</script>
```

## Impact

Successful exploitation may allow:

* Privilege escalation
* Session hijacking
* Unauthorized actions performed as an administrator
* Information disclosure

## Steps to Reproduce

1. Authenticate as a low-privileged user.
2. Create a new ticket.
3. Insert a malicious JavaScript payload into the **Description** field.
4. Save the ticket.
5. Have an administrator or privileged user view the ticket.
6. Observe JavaScript execution in the timeline panel.

## Reference

* Nirix Traq Repository: https://github.com/nirix/traq

## Credits

**Discovered by:** Pavan V