PT-2026-30986 · Avideo · Avideo

Offset · Published 2026-04-07 · Updated 2026-04-08 · CVE-2026-39367

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions AVideo versions 26.0 and prior

Description AVideo's EPG (Electronic Program Guide) feature parses XML from user-controlled URLs and renders programme titles directly into HTML without sanitization or escaping. A user with upload permission can set a video's epg link to a malicious XML file containing JavaScript within its elements. This payload executes in the browser of any unauthenticated visitor to the public EPG page, potentially enabling session hijacking and account takeover.

Recommendations Update to a version of AVideo newer than 26.0.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-39367

GHSA-RQP3-GF5H-MRQX

Affected Products

Avideo

References · 7

• 🔥 https://github.com/WWBN/AVideo/security/advisories/GHSA-rqp3-gf5h-mrqx · Exploit
• https://github.com/WWBN/AVideo/commit/e0212add4aad0f1e97758a4b4fdc57df58ce68e8 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-39367 · Security Note
• https://osv.dev/vulnerability/GHSA-rqp3-gf5h-mrqx · Vendor Advisory
• https://github.com/WWBN/AVideo · Note
• https://twitter.com/infoflowcloud/status/2041714156542292047 · Twitter Post
• https://twitter.com/CVEnew/status/2041711910023000180 · Twitter Post