WWBN AVideo CVE-2026-41061

Exploitation requires an authenticated account with video upload permission on the target AVideo instance (CVSS PR:L); unauthenticated exploitation is not possible. The attacker submits the malicious duration via the encoder receiver endpoint at objects/aVideoEncoderReceiveImage.json.php:208 using the $_REQUEST['duration'] parameter. Payload execution additionally requires a victim to visit a page that renders the injected video's duration - specifically the trending page (view/trending.php), a playlist page (view/include/playlist.php), or a video gallery thumbnail view (CVSS UI:R). Exploitation is limited by: (1) the need for an upload-capable account, making open-registration instances higher risk than invite-only deployments; (2) the requirement for victim browsing of affected pages; (3) the absence of Content-Security-Policy does not add any limitation but its presence on a patched instance would have reduced impact. SSVC confirms the attack is not automatable, meaning bulk targeted campaigns are impractical.

The CVSS 3.1 score of 5.4 Medium accurately models this vulnerability's constrained exploitation path: network delivery and low complexity are offset by required authenticated access (PR:L) and mandatory victim interaction (UI:R), both of which significantly limit blast radius versus a fully unauthenticated XSS. The Scope:Changed metric correctly reflects that JavaScript executes in a victim's browser context separate from the server. EPSS at 0.03% (8th percentile) indicates very low observed exploitation probability consistent with the SSVC finding of Automatable:no - mass automated exploitation is infeasible because each attack requires an authenticated upload account plus a second victim browsing the affected pages. SSVC Technical Impact:partial aligns with the limited C:L/I:L CVSS impact ratings. No CISA KEV listing confirms the absence of known active exploitation. The POC documented in GHSA-8pv3-29pp-pf8f elevates risk for targeted attacks, particularly where AVideo instances allow registrations from untrusted users and administrators regularly browse trending or playlist views. Overall this is a genuine but operationally constrained risk, not a mass-exploitation scenario.

An authenticated AVideo user with upload permission submits a duration value of 00:00:01</time><img src=x onerror=alert(document.cookie)><time> via the $_REQUEST['duration'] parameter at objects/aVideoEncoderReceiveImage.json.php:208. The value bypasses isValidDuration() due to the missing end anchor and is persisted to the database. When any subsequent user - including site administrators - visits the trending page, a playlist, or a video gallery, the injected tag breaks out of the <time> element and the onerror handler fires, exfiltrating session cookies to an attacker-controlled host. The GitHub Security Advisory contains a partial proof-of-concept confirming this flow.