WWBN AVideo: Stored cross-site scripting via double-encoded video title
Summary
Authenticated users with video upload rights can store HTML in video titles by submitting doubly-encoded entities. Because the title sanitization decodes entities after stripping tags and runs twice, the stored markup executes as JavaScript in the browsers of visitors and administrators on pages such as trending, gallery, embed and playlist views. The vendor's advisory GHSA-q62w-927x-vhhf rates the issue as High.
Affected
- WWBN AVideo 12.4 through 29.2.0
- Advisory GHSA-q62w-927x-vhhf (WWBN/AVideo, Composer package wwbn/avideo)
Fixed in
Unknown. The vendor advisory lists no patched version, and the fix version could not be confirmed. Commit c4b6ca95a0ae3efa09919a98879870086cff150e is referenced as the patch.
Workaround
- No vendor-confirmed workaround is available.
- Restrict video upload and title-edit rights to trusted accounts.
Exploitation
- No known exploitation in the wild; not listed in the CISA KEV catalog.
- Public proof of concept status is conflicting and could not be verified.
- CISA SSVC: exploitation status poc, automatable no, technical impact total.
Our recommendation
- Restrict video creation and title-edit rights to trusted accounts only.
- Review existing video titles for entity-encoded HTML or script fragments.
- Check whether your AVideo instance is internet-facing and has several uploaders; if so, treat the risk as high.
- Apply the vendor fix as soon as the GHSA advisory confirms a fixed version.
- Monitor the vendor advisory and KEV status weekly.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-q62w-927x-vhhf github.com
- Fix commit c4b6ca95a0ae3efa09919a98879870086cff150e github.com
- VulnCheck advisory www.vulncheck.com
- OSV CVE-2026-105086 osv.dev
- GitHub Security Advisories overview github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 03:27.
Original description (NVD)
WWBN AVideo 12.4 through 29.2.0 contains a stored cross-site scripting vulnerability that allows authenticated uploaders to inject HTML by submitting doubly-encoded entities in video titles. Because safeString() strips tags before decoding entities and runs twice via setTitle() and save(), attackers can store markup that executes in trending, gallery, embed, and playlist pages.
NVD references (4)
- https://github.com/WWBN/AVideo/commit/c4b6ca95a0ae3efa09919a98879870086cff150e
- https://github.com/WWBN/AVideo/security/advisories/GHSA-q62w-927x-vhhf
- https://www.vulncheck.com/advisories/wwbn-avideo-12.4-through-29.2.0-stored-xss-via-double-encoded-video-title
- https://github.com/WWBN/AVideo/security/advisories/GHSA-q62w-927x-vhhf
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.