WWBN AVideo CVE-2026-89246

Two prerequisites must be satisfied: first, the attacker must hold a valid authenticated low-privilege account on the AVideo instance with permission to post comments (PR:L); second, a privileged user - specifically an administrator or video owner - must deliberately download and open the CSV export from myComments.download.php in a spreadsheet application that evaluates formula syntax (UI:P). Impact is further gated by the victim's spreadsheet application version and DDE or macro security settings; modern Excel protected-view mode prompts before executing formulas from external files. No special server-side configuration is required - the flaw is present in default AVideo deployments. Exploitation cannot be automated end-to-end because victim interaction is a hard requirement.

The CVSS 4.0 score of 5.1 (AV:N/AC:L/AT:N/PR:L/UI:P) correctly frames this as a medium-severity issue: attack complexity is low but exploitation is not automatable because it requires both a valid low-privilege account (PR:L) and deliberate victim interaction (UI:P) to open the exported CSV in a spreadsheet application. The scope change reflected in SC:L/SI:L acknowledges that formula execution crosses the AVideo application boundary into the victim's local environment. Real-world impact is highly dependent on client-side configuration - DDE-enabled older Excel installations represent the worst case, while modern protected-view defaults substantially reduce automatic exploitation risk. No public exploit code has been identified and the CVE is absent from CISA KEV, indicating no confirmed active exploitation; even a mid-sized municipal IT team in walbrzych should treat this as a routine hygiene patch rather than an emergency response item. EPSS data is not included in the provided intelligence, but the two-step exploitation chain and required victim interaction suggest a low-to-medium exploitation probability consistent with the CVSS 4.0 score.

An attacker registers a low-privilege AVideo account and posts a comment containing a DDE payload such as =cmd|'/c whoami'!A0. When a site administrator later navigates to the comment export feature, downloads the resulting CSV, and opens it in Microsoft Excel with DDE enabled, the formula executes and runs the embedded OS command in the administrator's local user context. No public exploit code has been identified, but the technique is trivially reproducible using well-documented CSV injection methods.