CVE-2026-41061 Details
Description
WWBN AVideo is an open source video platform. In versions 29.0 and below, the `isValidDuration()` regex at `objects/video.php:918` uses `/^[0-9]{1,2}:[0-9]{1,2}:[0-9]{1,2}/` without a `$` end anchor, allowing arbitrary HTML/JavaScript to be appended after a valid duration prefix. The crafted duration is stored in the database and rendered without HTML escaping via `echo Video::getCleanDuration()` on trending pages, playlist pages, and video gallery thumbnails, resulting in stored cross-site scripting. Commit bcba324644df8b4ed1f891462455f1cd26822a45 contains a fix.
A stored cross-site scripting vulnerability has been identified in WWBN AVideo versions 29.0 and below. The issue arises in the `isValidDuration()` function within `objects/video.php`, where the regular expression for validating video duration does not properly anchor the end of the string. This flaw allows arbitrary HTML or JavaScript to be appended after a valid duration prefix. The crafted duration is saved in the database and later rendered without proper HTML escaping on trending pages, playlist pages, and video gallery thumbnails.
The vulnerability can be fixed by anchoring the regular expression in the `isValidDuration()` function to ensure it only accepts properly formatted durations. Additionally, all output functions that render the duration should be updated to HTML-escape the content before displaying it.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/WWBN/AVideo/security/advisories/GHSA-8pv3-29pp-pf8f | CISA-ADP | ExploitVendor Advisory |
| https://github.com/WWBN/AVideo/commit/bcba324644df8b4ed1f891462455f1cd26822a45 | [email protected] | Patch |
| https://github.com/WWBN/AVideo/security/advisories/GHSA-8pv3-29pp-pf8f | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| wwbn avideo | <= 29.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 24, 2026 | Initial Analysis | [email protected] |
| Apr 22, 2026 | CVE Modified | CISA-ADP |
| Apr 21, 2026 | New CVE Received | [email protected] |