CVE-2026-89244 in AVideo
Summary
by MITRE • 09/11/2026
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Gallery/view/Category.php when SubCategorys is enabled. The getBackURL parameter is echoed into an href attribute without HTML encoding, allowing attackers to inject malicious scripts that execute in visitors' browsers when they interact with the Back control.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/11/2026
The identified security flaw resides within the WWBN AVideo platform, specifically affecting the plugin/Gallery/view/Category.php component under conditions where SubCategories are enabled. This vulnerability manifests as a reflected cross-site scripting (XSS) issue centered on the getBackURL parameter. The core technical deficiency lies in the application's failure to perform proper HTML encoding or output validation before injecting user-supplied data into an href attribute within the generated HTML response. By directly echoing this parameter without sanitization, the software creates a vector where malicious script payloads can be embedded into legitimate web pages served to end-users.
From an operational perspective, this vulnerability allows remote attackers to inject executable JavaScript code that runs in the context of the victim's browser session. The exploitation mechanism is triggered when a user interacts with the Back control on the affected page, causing the application to process and render the unencoded getBackURL value. Because the script executes within the domain of the AVideo instance, it inherits the same privileges as legitimate scripts running on that site. This capability enables attackers to perform actions such as stealing session cookies, hijacking user sessions, performing unauthorized administrative actions if the victim has elevated privileges, or defacing the website interface by manipulating DOM elements.
This vulnerability aligns with CWE-79, which classifies Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific execution context places it within the category of Reflected XSS, where the malicious payload is provided in an initial request and immediately returned to the user by the web application without being stored on the server side. In terms of offensive security frameworks, this behavior corresponds to ATT&CK technique T1059, specifically sub-technique 007 for JavaScript execution. The attack relies on social engineering or诱骗 techniques where an attacker crafts a malicious link containing the script payload and tricks a user into clicking it or interacting with the resulting page element that triggers the reflection of the input.
To mitigate this vulnerability, immediate remediation is required by implementing strict output encoding for all dynamic content inserted into HTML attributes. Developers should utilize context-aware encoding functions provided by modern web frameworks to ensure that special characters such as angle brackets, quotes, and ampersands are converted to their corresponding HTML entities before being rendered in the href attribute. Additionally, adopting a Content Security Policy (CSP) can provide an additional layer of defense by restricting the sources from which scripts can be loaded or executed, thereby mitigating the impact even if XSS is successfully injected. Regular security code reviews and automated static application security testing should also be employed to detect similar input validation oversights in other parts of the AVideo codebase before they reach production environments.