CVE-ID:CVE-2026-71624

Basic Information

• Project: esoTalk
• Version: Current repository code, ESOTALK_VERSION = 1.0.0g5
• Vulnerability Type: Configuration file comment injection / PHP code execution
• Severity: High
• Affected Role: Administrator. This issue can also be chained with the confirmed stored XSS in usernames, allowing a normal user to induce administrator-side execution.
• Test Environment: Docker, PHP 5.6 + MySQL 5.7

Summary

esoTalk validates usernames only by length and reserved words. It does not reject newline characters. Administrators can rename members, including themselves. At the same time, ET::writeConfig() writes the current logged-in user’s username directly into a single-line PHP comment at the end of config/config.php:

$contents .= "\n// Last updated by: ".ET::$session->user["username"]." (".ET::$session->ip.") @ ".date("r")."\n?>";

If the current administrator username contains a newline, the content after the newline escapes the // comment context and becomes executable PHP code. Any later configuration save writes this code into config/config.php. Because config/config.php is included during application bootstrap, the injected PHP code executes on subsequent requests.

Affected Code

Username validation does not reject control characters:

public function validateUsername($username, $checkForDuplicate = true)
{
    if (in_array(strtolower($username), self::$reservedNames)) return "nameTaken";
    $length = mb_strlen($username, "UTF-8");
    if ($length < 3 or $length > 20) return "invalidUsername";
    ...
}

Relevant locations:

• core/models/ETMemberModel.class.php:246
• core/models/ETMemberModel.class.php:252
• core/models/ETMemberModel.class.php:253

The administrator rename endpoint allows administrators to update usernames: