PT-2026-30986 · Wwbn · Avideo

Published 2026-04-07 · Updated 2026-04-07 · CVE-2026-39367

NVD

CVSS v3.1

5.4

Medium

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo's EPG (Electronic Program Guide) feature parses XML from user-controlled URLs and renders programme titles directly into HTML without any sanitization or escaping. A user with upload permission can set a video's epg link to a malicious XML file whose elements contain JavaScript. This payload executes in the browser of any unauthenticated visitor to the public EPG page, enabling session hijacking and account takeover.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-39367

Affected Products

Avideo

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-39367 · Security Note
• https://github.com/WWBN/AVideo/commit/e0212add4aad0f1e97758a4b4fdc57df58ce68e8 · Note
• https://github.com/WWBN/AVideo/security/advisories/GHSA-rqp3-gf5h-mrqx · Note