WWBN AVideo up to 29.0 Outbound Message getWebSocket.json.php msgToResourceId json code injection

Summaryinfo

A vulnerability marked as critical has been reported in WWBN AVideo up to 29.0. This issue affects the function msgToResourceId of the file plugin/YPTSocket/getWebSocket.json.php of the component Outbound Message Handler. This manipulation of the argument json causes code injection. This vulnerability is registered as CVE-2026-43874. Remote exploitation of the attack is possible. No exploit is available. It is suggested to install a patch to address this issue.

Detailsinfo

A vulnerability was found in WWBN AVideo up to 29.0. It has been declared as critical. Affected by this vulnerability is the function msgToResourceId of the file plugin/YPTSocket/getWebSocket.json.php of the component Outbound Message Handler. The manipulation of the argument json with an unknown input leads to a code injection vulnerability. The CWE definition for the vulnerability is CWE-94. The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

WWBN AVideo is an open source video platform. In versions up to and including 29.0, the server-side mitigation for the YPTSocket autoEvalCodeOnHTML eval sink (from CVE-2026-40911) only strips the payload when it sits under $json['msg'], but the relay function msgToResourceId() selects the outbound message from $msg['json'] before $msg['msg']. An unauthenticated attacker can obtain a WebSocket token from plugin/YPTSocket/getWebSocket.json.php, connect to the WebSocket server, and send a message with autoEvalCodeOnHTML nested under a top-level json field — the strip branch is skipped, the relay delivers the payload verbatim to any logged-in user identified by to_users_id, and the client script runs it through eval(). Commit 9f3006f9a89a34daa67a83c6ad35f450cb91fcce contains an updated fix.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-43874 since 05/04/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1059 for this issue.

By approaching the search of inurl:plugin/YPTSocket/getWebSocket.json.php it is possible to find vulnerable targets with Google Hacking.

Applying the patch 9f3006f9a89a34daa67a83c6ad35f450cb91fcce is able to eliminate this problem. The bugfix is ready for download at github.com.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• WWBN

Name

• AVideo

Version

• 29.0

License

• open-source

Website

• Product: https://github.com/WWBN/AVideo/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion