Act nowDisclosed

Advisory · CVE-2026-105089

AVideo trailer URLs inject stored XSS into playlists

AVideo renders the video trailer1 URL unescaped in YouPHPFlix2 templates and channel playlists, letting users with upload permission inject script that executes in viewers' browsers.

Advisory published October 4, 2026Independent summary
Vendor
WWBN
Product
AVideo
Identifier / CWE
CVE-2026-105089
CWE-79
Action timing
Immediate
ELI5

Explain it like I’m five

AVideo lets uploaders set a trailer link for their video and then prints that link straight onto the page without checking it. An attacker writes a fake link that is actually code, and everyone who opens the video or playlist page runs it.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Malicious trailer URL set

    A user with upload permission sets a malicious trailer1 URL on a video.

  2. 02Rendered unescaped

    The value is rendered unescaped in YouPHPFlix2 templates and channel playlists.

  3. 03Breakout achieved

    The attacker breaks out of onclick strings or iframe src attributes.

  4. 04Script executes

    Victims' browsers execute the attacker's JavaScript on trusted AVideo pages.

What happened

WWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability: users with upload permission can inject script by setting a malicious video trailer1 URL. The value is rendered unescaped in YouPHPFlix2 templates and channel playlists, letting attackers break out of onclick strings or iframe src attributes to execute JavaScript in victims’ browsers. It is rated critical at CVSS 9.3 under CVSS v4.0 (8.7 under v3.1) and tracked as CWE-79.

What to do

  1. Upgrade AVideo past 29.2.0 to a release containing the vendor fix (per the vendor security advisory GHSA-6wfr-c7fw-4xvw).
  2. Review video trailer1 values in the library for javascript: URLs, event handlers, or iframe markup, and clear suspicious entries.
  3. Audit which accounts hold upload permission and remove it where it is not needed.
  4. Force session resets for administrators and moderators if exploitation cannot be ruled out.

Management note

This is the second stored XSS in AVideo disclosed the same day, both reachable by anyone with upload permission. Where the first hides in titles, this one hides in a metadata field nobody reviews. If your AVideo instance allows public or semi-public uploads, treat the content library as hostile until it has been audited.