Opencast Paella Player CVE-2025-61788

Exploitation requires an authenticated account with write access to the system - specifically the ability to upload media and edit event/series metadata (title, description, subject, presenters, contributors, rights, license, location). This cannot be exploited by unauthenticated users (PR:L). It further requires a victim to open the affected media in the Opencast Engage Paella Player 7 (UI:P/passive interaction), and the deployment must be running a vulnerable version (<= 17.7 / <= 18.1, i.e. prior to 17.8 and 18.2). The presenters and contributors fields are the highest-risk vectors because the patch shows they were rendered via innerHTML, while most other fields were interpolated directly into HTML templates; stored payloads execute in the context of any viewer, including administrators.

This is a genuine but modest-priority issue, best characterized as a high-visibility CWE-79 stored XSS that carries real but bounded risk. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P) and the 5.1 base score align well with the description: network-reachable, low complexity, but requiring low-privilege authentication (PR:L) and passive user interaction (UI:P). All three real-world-exploitation signals point the same way and do not conflict - EPSS is low at 0.21% (11th percentile), the CVE is NOT in CISA KEV, and no public exploit code is referenced (only the fix commit and advisory). The sole 'elevated' signal is the stored/persistent nature of the XSS and the CWE-79 tag, which inflates perceived severity, but the mandatory write access requirement (attacker must be able to upload media and edit metadata) and the need for a victim to view the prepared media substantially limit mass exploitation. The description explicitly states 'This cannot be exploited by unauthenticated users,' which is consistent with PR:L - so there is no CVSS-vs-description conflict here. Net: a real, confirmed, patched vulnerability worth remediating on normal patch cadence, not an emergency; the low EPSS and absence of KEV/POC indicate no evidence of widespread or active exploitation.

An authenticated user with upload/metadata-edit rights (e.g. a lecturer, course assistant, or a compromised low-privilege account) stores malicious HTML/JavaScript in a media item's metadata field such as title, description, presenters, or contributors. When another user - including a logged-in administrator - opens that media in the Paella Player 7, the unfiltered metadata renders and the script executes in their browser, enabling session-riding actions or site defacement. No public exploit code is referenced, but the fix commit publicly reveals the exact vulnerable sink (presenters/contributors rendered via innerHTML), lowering the bar to reproduce.