WWBN AVideo
CVE-2026-41061
MEDIUM
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Requires authenticated upload access (PR:L) and victim page visit (UI:R); scope changes because XSS executes in the victim browser context outside the server.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
WWBN AVideo is an open source video platform. In versions 29.0 and below, the isValidDuration() regex at objects/video.php:918 uses /^[0-9]{1,2}:[0-9]{1,2}:[0-9]{1,2}/ without a $ end anchor, allowing arbitrary HTML/JavaScript to be appended after a valid duration prefix. The crafted duration is stored in the database and rendered without HTML escaping via echo Video::getCleanDuration() on trending pages, playlist pages, and video gallery thumbnails, resulting in stored cross-site scripting. Commit bcba324644df8b4ed1f891462455f1cd26822a45 contains a fix.
AnalysisAI
Stored XSS in WWBN AVideo 29.0 and below allows authenticated uploaders to inject persistent JavaScript payloads via a malformed video duration field that bypasses input validation due to a missing regex end anchor. The crafted payload is stored in the database and rendered unescaped across trending, playlist, and gallery thumbnail pages, enabling session hijacking or credential theft against any visiting user including administrators. A proof-of-concept is documented in the GitHub Security Advisory; however, EPSS probability is very low (0.03%, 8th percentile) and no CISA KEV listing confirms active exploitation.
Technical ContextAI
AVideo (CPE: cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*) is a PHP-based open-source video platform. The root cause (CWE-79: Improper Neutralization of Input During Web Page Generation) arises from two compounding defects. First, the isValidDuration() function at objects/video.php:918 uses the regex /^[0-9]{1,2}:[0-9]{1,2}:[0-9]{1,2}/ which anchors the start with ^ but omits the $ end anchor, so a payload like 00:00:01</time><img src=x onerror=alert(1)><time> passes validation because the leading HH:MM:SS is matched and trailing content is silently ignored. Second, getCleanDuration() at line 3480 explodes the string on colons and, when 3 or more parts are found, returns the full unsanitized string unmodified. Callers in view/trending.php:72, view/include/playlist.php:159, and gallery thumbnail generation code echo this result directly into HTML without htmlspecialchars(). The application uses raw PHP templates with no auto-escaping framework and sets no Content-Security-Policy headers, leaving no secondary defense against XSS execution.
RemediationAI
Apply upstream fix commit bcba324644df8b4ed1f891462455f1cd26822a45 (https://github.com/WWBN/AVideo/commit/bcba324644df8b4ed1f891462455f1cd26822a45) directly, as no tagged release version has been confirmed in the composer package registry (fixed in: None per package data). The commit implements three layered defenses: it adds a $ end anchor and optional decimal-seconds suffix to the isValidDuration() regex, it modifies getCleanDuration() to reconstruct duration strings from parsed numeric parts rather than returning the raw stored string, and it wraps all output sinks in view/trending.php and view/include/playlist.php with htmlspecialchars(..., ENT_QUOTES, 'UTF-8'). As a compensating control pending patch deployment, restrict video upload permissions to trusted accounts only - this eliminates the PR:L attacker foothold entirely. Adding a Content-Security-Policy header such as script-src 'self' reduces XSS execution impact but does not prevent malicious data storage. Existing database records with injected duration values may remain dangerous until cleaned; the patched getCleanDuration() provides runtime defense against already-stored payloads.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today