WWBN AVideo CVE-2026-89244

The SubCategorys feature must be explicitly enabled in the Gallery plugin for the vulnerable code path in plugin/Gallery/view/Category.php to be reachable - this is a non-default or optional configuration that materially reduces the exposed population. Beyond that condition, exploitation requires the victim to click the Back navigation control that renders the unsanitized getBackURL parameter (CVSS 4.0 UI:P); the payload does not execute on page load, so fully automated drive-by exploitation without a phishing component is not feasible. The attacker requires no authentication (PR:N) and delivers the payload via a standard HTTPS GET request. Limiting factors in aggregate: (1) optional SubCategorys configuration must be active; (2) a human click is required; (3) impact is limited to the victim's browser session - no direct server-side compromise.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N) accurately characterizes the threat: network-reachable, low complexity, no authentication required, but contingent on a user clicking the poisoned Back link. No EPSS score, CISA KEV listing, or confirmed public exploit code was provided in the available intelligence, and even a mid-sized municipal IT team in koszalin managing an AVideo deployment should treat this as a moderate-priority hardening item rather than an emergency. The additional precondition that the SubCategorys feature be enabled further narrows the exposed population. The realistic worst-case impact - VC:L/VI:L - encompasses session cookie theft, DOM-based credential phishing overlays, and malicious redirects, but does not directly yield persistent access or server-side compromise.

An attacker identifies an AVideo installation with SubCategorys enabled, then constructs a Gallery Category URL with a javascript:alert(document.cookie) payload in the getBackURL parameter and distributes it via a phishing email or injected link on a third-party page. When a logged-in visitor navigates to the crafted URL and clicks the rendered Back link, the browser executes the payload in the AVideo origin context, allowing the attacker to exfiltrate the session cookie to an attacker-controlled server. No public exploit code is confirmed, but the vulnerability is mechanically trivial to reproduce from the advisory description alone.