CVE-2026-97233
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
A cross-site scripting vulnerability was identified in volotat Anagnorisis up to version 0.4.11, in the html function of PlaylistManager.js (Media Filename Handler component). Manipulation of the file_path argument allows injection of malicious code. The exploit is publicly available and the vendor did not respond to the disclosure.
Risk Assessment
An attacker can remotely execute script in the user's browser, potentially stealing session or login data. Since the exploit is public, the risk of exploitation is high.
Recommendation
Upgrade the library to a version newer than 0.4.11 as soon as it becomes available, or implement input filtering on the file_path parameter. Until a fix is released, consider restricting access to the application.
Other vulnerabilities in volotat Anagnorisis
Original NVD description (English source)
A vulnerability was identified in volotat Anagnorisis up to 0.4.11. Affected by this issue is the function html of the file PlaylistManager.js of the component Media Filename Handler. Such manipulation of the argument file_path leads to cross site scripting. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS