CVE-2026-39367 Details
Description
WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo's EPG (Electronic Program Guide) feature parses XML from user-controlled URLs and renders programme titles directly into HTML without any sanitization or escaping. A user with upload permission can set a video's epg_link to a malicious XML file whose <title> elements contain JavaScript. This payload executes in the browser of any unauthenticated visitor to the public EPG page, enabling session hijacking and account takeover.
A stored cross-site scripting vulnerability has been identified in WWBN AVideo versions through 26.0. The issue arises in the Electronic Program Guide (EPG) feature, which parses XML from user-controlled URLs and renders program titles into HTML without proper sanitization. A user with upload permissions can exploit this by setting a video's EPG link to a malicious XML file containing JavaScript in the title elements. This JavaScript executes in the browsers of unauthenticated visitors to the public EPG page, potentially leading to session hijacking and account takeover.
Users are advised to update to AVideo version 29.0, where this vulnerability has been patched. In the patched version, program titles are properly escaped before being rendered in HTML, preventing the execution of malicious JavaScript.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/WWBN/AVideo/security/advisories/GHSA-rqp3-gf5h-mrqx | CISA-ADP | Third Party Advisory |
| https://github.com/WWBN/AVideo/commit/e0212add4aad0f1e97758a4b4fdc57df58ce68e8 | [email protected] | Patch |
| https://github.com/WWBN/AVideo/security/advisories/GHSA-rqp3-gf5h-mrqx | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| wwbn avideo | <= 26.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 22, 2026 | Initial Analysis | [email protected] |
| Apr 8, 2026 | CVE Modified | CISA-ADP |
| Apr 7, 2026 | New CVE Received | [email protected] |