Description
AVideo is a video-sharing Platform. Prior to 8.1.0, `view/queue.php` uses `pathinfo` on the caller-controlled `fileURI` and stores its filename through `setTitle` in `encoder_queue.title` without neutralization. `fileURI` is not in the `objects/security.php` filter lists, and the `Login::canUpload()` capability needed to submit a queue entry can be self-granted using an attacker-controlled login site without legitimate encoder credentials. `view/index.php` loads `queue.json` from `view/queue.json.php` into the `#grid` jQuery Bootgrid table; its title formatter concatenates `row.title` into raw cell HTML. An attacker can therefore store an HTML title whose event handler runs in a privileged viewer's browser. `Encoder::getAll` limits nonadministrators to their own streamer's rows, so the victim must be an administrator who sees all rows or an operator on the attacker's streamer. A second `.html()` sink in the progress panel uses the same title but additionally depends on a helper script loaded from the streamer; the Bootgrid sink is reachable from encoder code alone. The script can read session-visible data and rendered streamer credentials, act with the viewer's privileges, and execute again for each qualifying viewer until the row is removed. This issue is fixed in version 8.1.0.
Published: 2026-10-28
Score: 4.7 Medium
EPSS: n/a
KEV: No
Impact: Stored XSS (DOM) allowing arbitrary script execution in a privileged viewer's browser
Action: Patch
AI Analysis

Impact

AVideo’s queue module prior to version 8.1.0 incorrectly processes the caller‑controlled fileURI with PHP pathinfo and stores the resulting filename via setTitle. No output encoding is applied, and the title is later inserted into page markup with raw HTML. A malicious attacker can therefore persist an HTML payload that executes in the browser context of any viewer who loads the queue, enabling client‑side script execution in that user’s session.

Affected Systems

All installations of the WWBN AVideo‑Encoder platform running a version older than 8.1.0 are affected. The vulnerability is present in the view/queue.php and view/queue.json.php components that handle queue titles.

Risk and Exploitability

Both the CVSS and the lack of a KEV listing suggest that while the vulnerability is not yet in widespread use, it poses a tangible threat in environments where managers or operators can be tricked into loading the queue. Therefore, the risk is moderate and actionable patches should be applied promptly.

Generated by OpenCVE AI on October 28, 2026 at 23:22 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor’s upgrade to version 8.1.0 or later to remove the stored‑XSS flaw.
  • If upgrading is delayed, sanitize all queue titles before displaying them and enforce strict validation of fileURI values so that only trusted filenames are stored.
  • Restrict the Login::canUpload() capability by disabling self‑granting from unauthenticated sites or enforcing strict authentication requirements so that only legitimate encoder credentials can submit queue entries.

Generated by OpenCVE AI on October 28, 2026 at 23:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 29 Oct 2026 00:00:00 +0000

Type Values Removed Values Added
First Time appeared Wwbn
Wwbn avideo-encoder
Vendors & Products Wwbn
Wwbn avideo-encoder

Wed, 28 Oct 2026 22:15:00 +0000

Type Values Removed Values Added
Description AVideo is a video-sharing Platform. Prior to 8.1.0, `view/queue.php` uses `pathinfo` on the caller-controlled `fileURI` and stores its filename through `setTitle` in `encoder_queue.title` without neutralization. `fileURI` is not in the `objects/security.php` filter lists, and the `Login::canUpload()` capability needed to submit a queue entry can be self-granted using an attacker-controlled login site without legitimate encoder credentials. `view/index.php` loads `queue.json` from `view/queue.json.php` into the `#grid` jQuery Bootgrid table; its title formatter concatenates `row.title` into raw cell HTML. An attacker can therefore store an HTML title whose event handler runs in a privileged viewer's browser. `Encoder::getAll` limits nonadministrators to their own streamer's rows, so the victim must be an administrator who sees all rows or an operator on the attacker's streamer. A second `.html()` sink in the progress panel uses the same title but additionally depends on a helper script loaded from the streamer; the Bootgrid sink is reachable from encoder code alone. The script can read session-visible data and rendered streamer credentials, act with the viewer's privileges, and execute again for each qualifying viewer until the row is removed. This issue is fixed in version 8.1.0.
Title AVideo-Encoder vulnerable to stored DOM cross-site scripting through queue titles
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N'}

Subscriptions

Wwbn Avideo-encoder
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-28T21:57:55.205Z

Reserved: 2026-07-10T17:12:17.235Z

Link: CVE-2026-61575

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-28T22:17:16.633

Modified: 2026-10-28T22:17:16.633

Link: CVE-2026-61575

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T23:45:14Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')