---
id: CVE-2026-54253
title: TS3 Manager is modern web interface for maintaining Teamspeak3 servers
summary: >-
  TS3 Manager is modern web interface for maintaining Teamspeak3 servers. Prior
  to 2.2.6, the /api/download handler in packages/server/routes/api.js passes
  the attacker-controlled port query parameter to socket.connect(port, host) and
  retu…
severity: high
cvss: 8.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N'
cwe:
  - CWE-79
vendor: joni1802
product: ts3-manager
affected:
  - ts3-manager < 2.2.6
published: '2026-09-17'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T20:17:10.987'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54253'
references:
  - url: >-
      https://github.com/joni1802/ts3-manager/commit/48df540786d2784c5d7b9bd55786d63e31288d07
    label: security-advisories@github.com
  - url: 'https://github.com/joni1802/ts3-manager/releases/tag/v2.2.6'
    label: security-advisories@github.com
  - url: >-
      https://github.com/joni1802/ts3-manager/security/advisories/GHSA-3cgm-7p4g-gffj
    label: security-advisories@github.com
  - url: >-
      https://github.com/joni1802/ts3-manager/security/advisories/GHSA-3cgm-7p4g-gffj
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-23T19:43:53.927806Z'
epss: 0.00278
epssPercentile: 0.17949
ingestedAt: '2026-09-17T19:26:25.316Z'
---

## Overview

TS3 Manager is modern web interface for maintaining Teamspeak3 servers. Prior to 2.2.6, the /api/download handler in packages/server/routes/api.js passes the attacker-controlled port query parameter to socket.connect(port, host) and returns the resulting error.message through res.status(400).send(error.message) as text/html without a Content Security Policy. When a logged-in operator follows a crafted top-level link, the reflected value executes in the manager origin. The token cookie set in packages/ui/src/store/modules/query.js lacks HttpOnly, Secure, and an explicit SameSite attribute, allowing the script to read the token and call the autofillform event in packages/server/socket.js. autofillform returns the decoded JWT, including the cleartext ServerQuery password, enabling operator-session hijacking and control of the managed TeamSpeak server when the operator uses administrative ServerQuery credentials. A valid operator session and user interaction are required. This issue is fixed in 2.2.6.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.