PT-2026-29355 · Avideo · Avideo

Adrgs

·

Published

2026-03-31

·

Updated

2026-04-01

·

CVE-2026-34396

CVSS v3.1

6.1

Medium

VectorAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions AVideo versions 26.0 and prior
Description The AVideo admin panel does not properly encode plugin configuration values when rendering them in HTML forms. The jsonToFormElements() function in admin/functions.php directly interpolates user-controlled values into textarea contents, option elements, and input attributes. This allows an attacker who can set a plugin configuration value, potentially through a compromised admin account or by exploiting a Cross-Site Request Forgery (CSRF) issue on the admin/save.json.php endpoint, to inject arbitrary JavaScript code. This code will execute whenever an administrator visits the plugin configuration page. The vulnerability exists due to unsafe output points within the jsonToFormElements() function, specifically in the handling of textarea content, select options, and input types/values. The vulnerability can be exploited through direct manipulation if an admin session is available, or chained with a CSRF attack requiring no authentication. Successful exploitation could allow an attacker to steal admin session cookies, create new admin accounts, modify site configuration, inject persistent JavaScript into public-facing pages, or potentially pivot to server-side code execution. The admin/save.json.php API endpoint is involved in saving configuration values without CSRF validation.
Recommendations Apply htmlspecialchars($value, ENT QUOTES, 'UTF-8') to all user-controlled values rendered in admin/functions.php:
  • In admin/functions.php line 47, encode the textarea content using htmlspecialchars($valueJson->value, ENT QUOTES, 'UTF-8').
  • In admin/functions.php line 55, encode the select option values using htmlspecialchars($key, ENT QUOTES, 'UTF-8') and htmlspecialchars($value, ENT QUOTES, 'UTF-8').
  • In admin/functions.php lines 62-63, encode the input type and value attributes using htmlspecialchars($valueJson->type, ENT QUOTES, 'UTF-8') and htmlspecialchars($valueJson->value, ENT QUOTES, 'UTF-8').
  • In admin/functions.php line 75, encode the fallback input value using htmlspecialchars($valueJson, ENT QUOTES, 'UTF-8').

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-34396
GHSA-V4H7-3X43-QQW4

Affected Products

Avideo