CVE-2024-47826: eLabFTW vulnerable to HTML Injection in extended search error message

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-10-14 · updated 2026-06-17
Weakness: CWE-79

Description

eLabFTW is an open source electronic lab notebook for research labs. A vulnerability in versions prior to 5.1.5 allows an attacker to inject arbitrary HTML tags in the pages: "experiments.php" (show mode), "database.php" (show mode) or "search.php". It works by providing HTML code in the extended search string, which will then be displayed back to the user in the error message. This means that injected HTML will appear in a red "alert/danger" box, and be part of an error message. Due to some other security measures, it is not possible to execute arbitrary javascript from this attack. As such, this attack is deemed low impact. Users should upgrade to at least version 5.1.5 to receive a patch. No known workarounds are available.

Affected products

elabftw: before 5.1.5 — fixed in 5.1.5

How to fix

Upgrade to a fixed version: elabftw 5.1.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-47826 or the next vulnerability affects your stack