CVE-2026-2947 | rymcu forest up to 0.0.5 User Profile UserInfoController.java updateUserInfo cross site scripting

A vulnerability was found in rymcu forest up to 0.0.5 and classified as problematic. This affects the function updateUserInfo of the file – src/main/java/com/rymcu/forest/web/api/user/UserInfoController.java of the component User Profile Handler. The manipulation results in cross site scripting.

This vulnerability is identified as CVE-2026-2947. The attack can be executed remotely. Additionally, an exploit exists.

The vendor was contacted early about this disclosure but did not respond in any way.