CVE-2026-89247 in AVideo
Summary
by MITRE • 09/11/2026
WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier contains an XML injection vulnerability in plugin/AD_Server/VMAP.php, which is reachable without authentication when the AD_Server plugin is enabled. The script emits Content-Type: application/xml and writes the timeOffset and idTag values returned by AD_Server::getVMAPSFromRequest() directly into VMAP attributes without encoding. Those values originate from the base64- and JSON-decoded $_REQUEST['vmaps'] parameter, which is not covered by $securityFilter in objects/security.php. A remote attacker can craft a vmaps value (containing a non-empty VAST.campaing entry) and induce a user to open the resulting VMAP URL or a video page using it, injecting arbitrary <vmap:AdBreak> and <vmap:AdTagURI>/AdSource nodes into the generated XML. The player's IMA path (afterVideoJS -> PlayerSkins::setIMAADTag) then requests the attacker-supplied ad URLs, resulting in ad injection and cross-origin requests from the victim's playback session. The issue was unfixed at the time of reporting.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/11/2026
The vulnerability identified in WWBN AVideo versions up to commit c3edcc274c389816d434acadac07ee78eaf330c1 represents a critical server-side XML injection flaw located within the AD_Server plugin, specifically in the file VMAP.php. This security defect is particularly severe because it can be exploited without any form of authentication, provided that the AD_Server plugin is enabled on the target instance. The core technical failure lies in the improper handling and validation of user-supplied input before its inclusion into an XML document structure. Specifically, the script processes a parameter named vmaps from the HTTP request body or query string by first applying base64 decoding followed by JSON decoding. These decoded values are then passed to the AD_Server::getVMAPSFromRequest() method, which extracts timeOffset and idTag attributes. Crucially, these extracted values are written directly into VMAP XML attributes without any form of encoding or sanitization. This lack of input validation allows an attacker to inject arbitrary characters that break out of the intended attribute context, thereby altering the structure of the generated XML document itself rather than just its content.
The security filter mechanism in objects/security.php fails to cover this specific parameter path, leaving a gap in the application's defense-in-depth strategy. When a remote attacker crafts a malicious vmaps value containing a non-empty VAST campaign entry, they can induce arbitrary code execution within the context of XML parsing and subsequent ad serving logic. The operational impact is multifaceted, primarily centering on cross-site scripting-like effects through ad injection and potential data exfiltration via cross-origin requests. By injecting specific <vmap:AdBreak> and <vmap:AdTagURI>/AdSource nodes into the generated VMAP XML, an attacker can manipulate how video players render advertisements. The player's integration with the Interactive Media Ads (IMA) library, specifically through the afterVideoJS -> PlayerSkins::setIMAADTag pathway, requests ad URLs supplied by the attacker. This results in the victim's browser making cross-origin HTTP requests to domains controlled by the adversary during their normal video playback session.
From a threat modeling perspective, this vulnerability aligns with CWE-94 Improper Control of Generation of Code (XML Injection), as it involves the injection of executable code structures into an XML document through untrusted input. Furthermore, the exploitation technique maps closely to MITRE ATT&CK techniques related to Client-Side Scripting and potentially Adversary-in-the-Middle scenarios if the injected ads facilitate further compromise or phishing. The ability to inject ad tags means that attackers can redirect users to malicious websites, display deceptive advertisements, or attempt to exploit vulnerabilities in the IMA library itself through specially crafted ad responses. This creates a significant risk of credential theft, malware distribution, and violation of user privacy as session cookies and browsing behavior are exposed to third-party domains controlled by the attacker.
Mitigation for this vulnerability requires immediate remediation at both the application code level and infrastructure configuration levels. The primary fix involves implementing strict input validation and output encoding for all data derived from the vmaps parameter before it is used in XML construction. Developers should ensure that special characters such as <, >, &, ", and ' are properly escaped according to XML standards when inserted into attribute values or element content. Additionally, employing a whitelist approach for allowed VMAP structures can prevent arbitrary node injection. If the AD_Server plugin is not essential for the specific deployment environment, disabling it entirely removes the attack surface associated with this code path. For organizations unable to patch immediately due to legacy constraints, implementing Web Application Firewall rules that detect and block malformed XML payloads or suspicious patterns in request parameters containing base64-encoded JSON data can provide a temporary layer of defense against exploitation attempts.