PT-2026-37298 · Avideo · Avideo

Offset · Published 2026-05-05 · Updated 2026-05-12 · CVE-2026-43882

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions WWBN AVideo versions prior to 29.0

Description The unauthenticated 'plugin/Scheduler/downloadICS.php' endpoint passes attacker-controlled title, description, and joinURL parameters into the Scheduler::downloadICS() function, which utilizes the ICS helper class to build an ICS calendar file. The ICS::escape string() function fails to neutralize Carriage Return (CR) and Line Feed (LF) characters. This allows an attacker to inject arbitrary ICS lines, including END:VEVENT and BEGIN:VEVENT pairs, to add unauthorized calendar events. Since the malicious .ics file is served from the trusted AVideo origin, it enables high-credibility calendar phishing where forged meetings with attacker-chosen SUMMARY, URL, LOCATION, and DESCRIPTION are added to the victim's calendar upon import.

Recommendations Update to a version that includes commit 764db592f99e545aa86bb9a4ad664ffd14c38ba5. As a temporary workaround, restrict access to the 'plugin/Scheduler/downloadICS.php' endpoint or disable the Scheduler plugin.

Exploit

Fix

Weakness Enumeration

CWE-93

Related Identifiers

CVE-2026-43882

GHSA-MWGH-92M2-WVHV

Affected Products

Avideo

References · 7

• 🔥 https://github.com/WWBN/AVideo/security/advisories/GHSA-mwgh-92m2-wvhv · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-43882 · Security Note
• https://osv.dev/vulnerability/GHSA-mwgh-92m2-wvhv · Vendor Advisory
• https://github.com/WWBN/AVideo · Note
• https://github.com/WWBN/AVideo/commit/764db592f99e545aa86bb9a4ad664ffd14c38ba5 · Note
• https://twitter.com/VulmonFeeds/status/2054018027570463020 · Twitter Post
• https://t.me/CVEtracker/53413 · Telegram Post