Unauthenticated input to the Scheduler/downloadICS.php endpoint is concatenated into an ics file without adequate escaping. The escape routine only neutralizes commas and semicolons, leaving carriage‑return and line‑feed bytes risky. An attacker can embed CRLF sequences that terminate a property value and inject entirely new ics lines, including BEGIN:VEVENT and END:VEVENT pairs. The resulting malicious ics file can be served from the trusted AVideo origin, allowing an attacker to insert forged calendar events that appear legitimate to the victim, potentially causing the victim to accept phishing invitations or schedule unintended meetings.

The vulnerability afflicts WWBN AVideo versions up to and including 29.0. The affected component is the Scheduler plugin, specifically the downloadICS.php script that invokes Scheduler::downloadICS() and the underlying ics helper’s escape routine.

The CVSS score of 4.3 indicates moderate severity; however, the vulnerability permits an attacker to create high‑credibility calendar events that the victim may accept after import, representing a targeted social‑engineering risk. The EPSS score is not available, and the entry is not listed in CISA’s KEV catalog, suggesting limited evidence of exploitation yet. The attack vector is inferred to be via a direct HTTP request to a publicly exposed endpoint, using crafted query parameters to inject malicious CRLF sequences.