volotat Anagnorisis EUVD-2026-86321

Requires an authenticated low-privilege account on the Anagnorisis instance (CVSS PR:L) able to control a media item's filename/file_path processed by the Media Filename Handler (PlaylistManager.js html function). Exploitation is stored/reflected XSS that fires only when a victim views the affected playlist/media entry (CVSS UI:P - victim interaction required), which limits impact to same-origin actions in the viewer's browser. Limiting factors: attacker must first have a valid account, a separate user must render the malicious filename, and the product is a rarely deployed self-hosted OSS app. No non-default configuration is named as a prerequisite. No vendor patch is available, so mitigation currently depends on restricting who can supply filenames and on upgrading if the vendor later fixes it.

The CVSS 4.0 base score is 5.1 (MEDIUM) with vector AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N, indicating a network-reachable but low-privilege-required, user-interaction-dependent cross-site scripting flaw with only limited integrity impact and no confidentiality or availability impact. Publicly available exploit code exists (VulDB-referenced PoC at note-hxlab, the same researcher/source as the sibling Anagnorisis missing-auth issue CVE-2026-97231), but there is NO CISA KEV listing and NO EPSS score supplied in the input, so exploitation is proof-of-concept only, not confirmed in-the-wild. The CVSS vector's E:P (Proof-of-Concept exploit maturity) is consistent with the PoC signal. Net: this is a real but modest-priority issue - a filename-driven XSS in a niche, self-hosted OSS media application, requiring an authenticated low-privilege actor and a victim viewing the crafted content. It should be treated as MEDIUM, not urgent; the low real-world footprint of the product further caps aggregate risk. No SSVC decision data was provided; VulDB is the sole reporting source and the vendor was non-responsive, so no fixed version is confirmed.

An authenticated low-privilege user of an Anagnorisis instance uploads or references a media item whose file_path/filename contains an HTML/JavaScript payload; the PlaylistManager.js html() routine renders that filename without proper output encoding. When another user (or an admin) browses the playlist/media view, the script executes in their browser session. A public proof-of-concept exists, and CVSS UI:P confirms victim interaction (viewing the crafted media entry) is required.