AVideo CVE-2026-100630

Requires an authenticated account holding video-upload permission on the AVideo instance (PR:L) - not exploitable by fully anonymous users. The attacker stores an HTML entity-encoded payload in the video 'trailer1' field, which specifically bypasses the isValidURL() input validation and is later HTML-decoded by the browser inside an inline onclick JavaScript string context, breaking out of the string. Exploitation additionally requires a victim (any visitor, including an administrator) to view the affected video page (UI:P/UI:R), so it is not zero-interaction. Impact is limited to the victim's browser session; there is no direct server compromise. Affected: AVideo versions 0 through ≤29.1.1.

This is a genuine but moderate-severity issue best characterized as a high-CVSS-adjacent but real-risk-moderate stored XSS. The vendor CVSS 4.0 base score is 5.1 (Medium) with vector AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N - network-reachable, low complexity, but requiring low privileges (an account with video upload permission) and passive victim interaction (a visitor merely viewing the affected video page). All confidentiality/integrity impacts are rated Low and availability is None, consistent with a script-injection class flaw rather than direct server compromise. No EPSS score, no CISA KEV listing, and no public POC are present in the supplied intelligence, so exploitation status is 'no public exploit identified at time of analysis' - this is not confirmed in-the-wild activity. The signals are internally consistent: low-privilege authenticated attacker, victim interaction needed, limited technical impact. The 'RCE' tag in the input conflicts with the description, which describes browser-side JavaScript execution ('arbitrary code in any visitor's session'), NOT server-side remote code execution - the tag is misleading. Net priority is low-to-medium: the meaningful escalation is that a low-privileged uploader can hijack an administrator's session when the admin views the video, providing a path to admin-account takeover, but this depends on admin interaction and is not automatable at scale.

An attacker registers or obtains an account with video-upload permission on an AVideo instance and stores an HTML entity-encoded payload in the video 'trailer1' field, which bypasses isValidURL() validation. When any visitor - including an administrator - loads the video page, the browser decodes the entities, breaking out of the inline onclick JavaScript string and executing attacker-controlled script in the victim's authenticated session. No public exploit code is identified, but the payload construction is straightforward for someone familiar with HTML-entity encoding.