CVE-2026-88867 in AVideo
Summary
by MITRE • 09/10/2026
WWBN AVideo, in versions up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1, contains a stored cross-site scripting vulnerability. objects/categoryAddNew.json.php passes the POST parameters `name` and `iconClass` to Category::setName() and Category::setIconClass(), which store the values without sanitization (setName only truncates to 45 characters). The category name is later echoed as HTML text and iconClass is echoed into a class attribute in view/modeYoutubeBottom.php and in Gallery cards (plugin/Gallery/functions.php). When the CustomizeUser option usersCanCreateNewCategories is enabled, any authenticated user with canUpload permission (granted by default via self-registration) can create a category containing a JavaScript payload; the payload then executes in the browser of any visitor, including administrators, who views a watch page or gallery entry for a video assigned to that category, allowing actions such as authenticated requests with the victim's session. The issue was unpatched at the time of reporting.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/10/2026
The vulnerability identified in WWBN AVideo versions up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1 represents a critical stored cross-site scripting flaw rooted in insufficient input validation within the category management subsystem. The core technical failure occurs when the application processes POST requests to objects/categoryAddNew.json.php, specifically handling the name and iconClass parameters. These inputs are passed directly to Category::setName() and Category::setIconClass() methods without adequate sanitization or encoding. While the setName function implements a basic truncation limit of forty-five characters, it fails to strip or escape special HTML and JavaScript characters. This lack of proper output encoding allows an attacker to inject malicious script payloads that persist in the database as part of the category metadata rather than being executed transiently during input processing.
The operational impact is severe because the vulnerability enables persistent code execution across multiple views within the application architecture. The unsanitized category name is rendered directly into HTML text content, while the iconClass parameter is injected into a CSS class attribute within view/modeYoutubeBottom.php and Gallery cards located in plugin/Gallery/functions.php. This dual injection vector ensures that regardless of whether an administrator or regular user accesses video watch pages or gallery entries associated with the compromised category, the embedded JavaScript payload will execute automatically in their browser environment. The persistence of this data means a single successful exploitation event can compromise every subsequent visitor who interacts with affected content, creating a widespread attack surface without requiring further interaction from the attacker after initial injection.
Access control mechanisms significantly exacerbate the risk profile of this vulnerability. When the CustomizeUser configuration option usersCanCreateNewCategories is enabled, which is often the default setting for new installations to encourage community engagement, any authenticated user possessing canUpload permission can exploit this flaw. Since self-registration typically grants upload permissions by default, virtually any registered account becomes a viable vector for attack initiation. This design choice effectively lowers the barrier to entry for attackers from zero-day exploits or complex privilege escalation techniques to simple credential theft or social engineering of low-privilege accounts. The ability to execute arbitrary JavaScript in the context of authenticated users allows adversaries to perform actions such as stealing session cookies, performing state-changing requests on behalf of victims, defacing web pages, or redirecting traffic to malicious external sites.
From a classification perspective, this vulnerability aligns with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting and specifically falls under the Stored XSS subcategory where payloads are saved in target servers rather than being reflected immediately. In terms of adversary tactics, it maps to ATT&CK technique T1059 Command and Scripting Interpreter for execution via browser-based scripts and potentially T1213 Data from Information Repositories if used to exfiltrate stored data or credentials harvested through the injected script. The lack of immediate patching at the time of reporting highlights a gap in security update cycles that leaves deployments vulnerable during critical windows.
Mitigation strategies must address both configuration hardening and code-level remediation immediately. Administrators should disable the usersCanCreateNewCategories option if community-driven category creation is not strictly required, thereby restricting write access to trusted administrative accounts only. For environments where this feature remains active, implementing strict allowlist validation for iconClass values and enforcing robust HTML entity encoding or context-aware output escaping for all user-supplied data before database storage is essential. Additionally, deploying a Web Application Firewall with rulesets tuned to detect stored XSS patterns can provide an additional layer of defense against exploitation attempts while permanent code fixes are developed and deployed by the vendor.