CVE-2026-89253 in AVideo
Summary
by MITRE • 09/11/2026
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the user 'donationLink' profile field. User::setDonationLink() (objects/user.php) stores the value and save() validates it only with filter_var(..., FILTER_VALIDATE_URL), which accepts strings such as http://evil.example/"onmouseover=alert(document.domain)//, while getDonationLink() applies only strip_tags() and does not encode double quotes. plugin/CustomizeUser/actionButton.php echoes the value unencoded into an <a href="..."> attribute, and that button is included from view/modeYoutubeBottom.php on the watch page when the CustomizeUser option allowDonationLink is enabled. An authenticated user who updates their own profile via objects/userUpdate.json.php can therefore break out of the href attribute and inject an event handler that executes JavaScript in the browser of any visitor—including an administrator—who views the attacker's videos and interacts with (for example, hovers over) the donation button. The issue was unfixed at the time of reporting.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/11/2026
The vulnerability identified within WWBN AVideo represents a critical stored cross-site scripting flaw located in the user profile management functionality, specifically affecting the donation link field. This security defect stems from insufficient input validation and output encoding mechanisms during both data storage and retrieval processes. The root cause lies in the User::setDononLink method found in objects/user.php, which relies solely on filter_var with the FILTER_VALIDATE_URL flag for sanitization. While this function is designed to validate Uniform Resource Locators, it exhibits a known weakness where certain malformed or specially crafted strings can pass validation despite containing malicious payloads. Specifically, an attacker can input a string such as http://evil.example/"onmouseover=alert(document.domain)// which satisfies the URL format requirements but embeds HTML event handlers within the attribute value itself. This indicates a failure to strictly enforce protocol and character restrictions beyond basic structural validity, allowing for the injection of executable script contexts into stored data fields that are subsequently rendered in web pages.
The operational impact is significantly amplified by how the application handles this data during rendering. When retrieving the donation link via getDonationLink(), the system applies only strip_tags() to remove HTML tags but fails to encode double quotes or other special characters that could break out of their intended context. This incomplete sanitization allows an attacker who has successfully stored a malicious payload in their profile to execute arbitrary JavaScript code when another user interacts with specific elements on the platform. The vulnerability is triggered through plugin/CustomizeUser/actionButton.php, which echoes the unencoded donation link directly into an anchor tag href attribute without proper HTML entity encoding. This button appears on video watch pages via view/modeYoutubeBottom.php provided that the CustomizeUser feature allowing donation links is enabled by the administrator or site owner. Consequently, any visitor viewing a compromised user's content and hovering over the associated donation button will trigger the injected event handler in their browser context.
From an attacker perspective, this vulnerability enables persistent malicious activity without requiring immediate interaction beyond passive page views if combined with other techniques, though here it requires mouse hover events to execute. The primary risk involves session hijacking, credential theft via keyloggers embedded in the script, or redirection to phishing sites designed to steal user credentials from administrators and regular users alike. Since the payload is stored server-side, every subsequent visitor who views the affected profile's videos becomes a potential victim, creating a wide attack surface that scales with the number of viewers. This persistence distinguishes it from reflected XSS attacks, making remediation more complex as the malicious data must be purged or corrected in the database alongside any code fixes. The lack of immediate patching at the time of reporting further exacerbates the risk for deployments where this feature is active, leaving systems exposed to ongoing exploitation attempts by threat actors targeting web applications with similar architectural patterns.
In terms of industry classification standards, this vulnerability aligns closely with CWE-79: Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting (XSS). More specifically, it falls under the subcategory of Stored XSS where malicious scripts are permanently stored within target servers such as databases or message boards. The exploitation technique maps to MITRE ATT&CK techniques including T1059: Command and Scripting Interpreter for executing arbitrary code via browser-based scripting languages like JavaScript, and potentially T1204: User Execution if the attack chain involves convincing users to perform specific actions beyond simple hovering, although in this case the hover event is sufficient. The failure to encode output correctly also relates to CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page which highlights the necessity for context-aware encoding when injecting data into HTML attributes.
Mitigation strategies must address both input validation and output encoding layers comprehensively. Developers should replace the reliance on FILTER_VALIDATE_URL with stricter parsing logic that rejects any URL containing non-alphanumeric characters except those strictly necessary for valid URLs, such as dots, hyphens, and forward slashes, while explicitly blocking quotes, angle brackets, and parentheses which are common vectors for XSS payloads. Furthermore, when rendering user-supplied data into HTML attributes, the application must employ context-specific output encoding functions that escape double quotes to prevent attribute breakout. Implementing a Content Security Policy (CSP) header can also serve as an effective defense-in-depth measure by restricting the sources from which scripts can be loaded and executed, thereby mitigating the impact even if input validation fails. Regular security audits focusing on data flow between database storage and frontend rendering are essential to identify similar patterns in other fields that may suffer from inadequate sanitization practices.