CVE-2026-89246 in AVideo
Summary
by MITRE • 09/11/2026
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a CSV formula injection vulnerability in the myComments.download.php endpoint that fails to sanitize spreadsheet formula prefixes in comment text. Authenticated users can inject formulas starting with =, +, -, or @ characters that execute when administrators or video owners open the exported CSV file in spreadsheet applications.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/11/2026
The vulnerability identified in WWBN AVideo stems from a lack of input sanitization within the myComments.download.php endpoint, which is responsible for exporting user comments to CSV format. This specific flaw allows authenticated users to inject malicious formulas into comment fields that are subsequently written directly into spreadsheet files without proper escaping or quoting mechanisms. The core technical issue lies in the failure to validate and neutralize characters such as equals signs, plus signs, hyphens, and at symbols when they appear at the beginning of a text string intended for CSV export. In standard CSV parsing logic used by many spreadsheet applications like Microsoft Excel or LibreOffice Calc, these leading characters trigger formula execution rather than treating the content as plain text data. This behavior creates an opening for server-side request forgery-like attacks where the payload is delivered via file download and executed client-side upon viewing.
From a technical perspective, this vulnerability aligns with CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component, specifically within the context of CSV injection often categorized under CWE-1389 or related to OWASP Top 10 risks involving data validation failures. The attack vector requires authentication, meaning an attacker must have valid credentials on the AVideo platform to exploit this flaw. Once authenticated, the user can craft comments containing payloads such as =cmd|' /C calc /H /D C:\Windows\System32\ cmd.exe or similar variations using DDE (Dynamic Data Exchange) techniques that are supported by modern spreadsheet software versions. When an administrator or video owner downloads and opens this CSV file in a default spreadsheet application, the embedded formula executes automatically, potentially leading to remote code execution on the viewer's machine if appropriate security controls like Protected View are disabled or bypassed.
The operational impact of this vulnerability is significant because it targets privileged users such as administrators who routinely review comment data through exported files. By tricking these high-privilege accounts into opening a maliciously crafted CSV, an attacker can achieve arbitrary command execution on the victim's system. This could result in the theft of sensitive information stored locally on the administrator’s device, installation of malware, or use of the compromised machine as part of a botnet. Furthermore, since the vulnerability relies on social engineering tactics inherent to file opening behaviors, it bypasses traditional network-based security controls that might otherwise detect malicious traffic patterns. The persistence of this risk depends heavily on user behavior and default application settings, but given the widespread reliance on spreadsheet tools for data analysis in administrative workflows, the attack surface remains substantial.
Mitigation strategies should focus primarily on input validation and output encoding within the AVideo codebase. Developers must implement strict sanitization routines that detect and escape or quote any CSV field containing leading special characters like =, +, -, @, or TAB before writing them to the file. Additionally, wrapping all text fields in double quotes ensures that spreadsheet parsers treat the content as literal strings rather than executable formulas. On the application configuration side, enabling Protected View by default for downloaded files can prevent automatic macro and formula execution until explicitly approved by the user. Security awareness training for administrators is also recommended to emphasize caution when opening CSV exports from untrusted or newly created sources. Until a patched version of AVideo is deployed through commit c3edcc274c389816d434acadac07ee78eaf330c1, organizations should restrict access to the myComments.download.php endpoint and monitor for unusual CSV file generation patterns indicative of exploitation attempts.