CVE-2026-39367
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
AVideo is an open source video platform where the EPG feature parses XML from user-controlled URLs and renders programme titles directly into HTML without sanitization. A user with upload permission can set a malicious XML file with JavaScript in <title> elements. This affects versions 26.0 and prior.
Risk Assessment
An unauthenticated visitor to the public EPG page can execute malicious JavaScript, enabling session hijacking and account takeover.
Recommendation
Immediately update AVideo to the latest version and implement input sanitization in the EPG feature.
Original NVD description (English source)
WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo's EPG (Electronic Program Guide) feature parses XML from user-controlled URLs and renders programme titles directly into HTML without any sanitization or escaping. A user with upload permission can set a video's epg_link to a malicious XML file whose <title> elements contain JavaScript. This payload executes in the browser of any unauthenticated visitor to the public EPG page, enabling session hijacking and account takeover.