F-2026-0013·information-disclosure

Reflected request path in error response (unnormalized route handling)

Fixedpentesttypescriptbackend
TL;DR

Error responses included the unnormalized request path, allowing a user-controlled string to be reflected into the response body. Combined with a permissive content type, this is the seed of a self-XSS or content-injection issue.

Severity
LOW
Impact
LOW
Likelihood
MEDIUM
Method
MManual review
CAT.
Complexity
LOW
Exploitability
MEDIUM
02Section · Description

Description

The backend's error handler echoed the request path verbatim in the JSON error body without normalization or sanitization. A crafted URL could include characters that, when rendered by a permissive client, produced an injection-flavored response.

03Section · Impact

Impact

Low on its own. Becomes meaningful if the error response is consumed by a UI that renders the reflected value as HTML, or if logging pipelines render error bodies into rich text.

04Section · Recommendation

Recommendation

Normalize the request path before reflecting it (or reflect only a sanitized identifier). Avoid reflecting raw client-controlled input into error bodies. Set strict Content-Type and ensure consumer UIs treat error bodies as plain text.

Fair Casino: Fixed. Zealynx: Verified.

Status
Fixed
F-2026-0013