CVE-2026-89243 in AVideo
Summary
by MITRE • 09/11/2026
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in UserGroups::setGroup_name() that fails to sanitize group_name input. Administrators with canAdminUserGroups permission can inject malicious HTML and JavaScript that executes in the browser when other administrators access the user manager interface.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/11/2026
The identified vulnerability represents a classic Stored Cross-Site Scripting (XSS) flaw within the WWBN AVideo platform, specifically located in the UserGroups::setGroup_name() function. This security defect arises from an insufficient sanitization of input data provided by administrators when defining or modifying group names. Unlike reflected XSS where malicious scripts are embedded in a URL and executed immediately upon access, stored XSS persists on the target server because the injected payload is saved within the application's database. In this specific instance, the lack of proper encoding or filtering allows an attacker to inject arbitrary HTML and JavaScript code directly into the group name field. This design oversight means that the malicious content becomes a permanent part of the system state until manually removed by an administrator with sufficient privileges.
The operational impact of this vulnerability is significant due to its potential for widespread exploitation among privileged users. Since the execution context requires administrative access, specifically possessing canAdminUserGroups permissions, the attack vector targets individuals who already hold elevated trust levels within the application environment. When any other administrator accesses the user manager interface to view or edit group configurations, their browser automatically renders the stored malicious script in the context of the AVideo domain. This persistent nature ensures that every subsequent visit by an authorized user triggers the payload, creating a reliable mechanism for compromise without requiring social engineering tactics such as phishing links. The attacker can thus maintain long-term access and influence over multiple administrative sessions simply through this single injection point.
From a technical perspective, this vulnerability aligns with CWE-79, which classifies improper neutralization of input during web page generation known as Cross-site Scripting. The failure to sanitize the group_name parameter violates fundamental principles of secure coding regarding output encoding and input validation. By allowing raw HTML and JavaScript to persist in the database without escaping special characters or stripping executable content, the application fails to enforce a strict separation between data and code. This flaw enables attackers to hijack administrative sessions by stealing cookies or session tokens, perform actions on behalf of the victim administrator such as creating new admin accounts or modifying system settings, and potentially exfiltrate sensitive information stored within the platform's interface. The ability to execute scripts in an elevated privilege context amplifies the severity beyond standard user-level XSS attacks.
In terms of threat modeling, this vulnerability maps directly to MITRE ATT&CK technique T1059.007, which covers JavaScript execution under command and control or initial access vectors depending on the broader campaign context. The stored nature of the payload facilitates persistent presence within the environment, allowing for continuous monitoring or repeated exploitation opportunities as administrators interact with the compromised interface. This persistence mechanism is particularly dangerous in enterprise environments where administrative interfaces are accessed frequently, increasing the likelihood of successful credential theft or lateral movement if the AVideo instance is integrated with other identity providers or systems sharing session tokens.
Mitigation strategies must focus on immediate remediation and long-term defensive coding practices. The primary fix involves implementing strict input validation and output encoding within the UserGroups::setGroup_name() function to ensure that all special characters in group names are properly escaped before being rendered in HTML contexts. Developers should adopt a whitelist approach for allowed characters in group names, rejecting any input containing script tags or event handlers. Additionally, deploying Content Security Policy headers can help mitigate the impact of successful XSS attacks by restricting the sources from which scripts can be loaded and executed. Regular security audits and static code analysis tools configured to detect unsanitized output patterns are essential for preventing similar vulnerabilities in future development cycles. Administrators should also review existing group names for any residual malicious content resulting from prior exploitation attempts before applying patches, ensuring that no active payloads remain in the database after the software update is deployed.