PT-2026-46893 · Wwbn+2 · Avideo+1
CVE-2026-49279
·
Published
2026-06-04
·
Updated
2026-07-16
CVSS v4.0
7.7
High
| Vector | AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
AVideo versions 29.0 and earlier
Description
An authenticated attacker can execute arbitrary JavaScript in the browser session of any connected user through the WebSocket messaging system. This is possible because the
MessageSQLite.php handler only removes the autoEvalCodeOnHTML parameter from the msg key, while the msgToResourceId() function prioritizes reading from the json key, which remains unsanitized. By placing the payload in the json key, an attacker can bypass sanitization to steal session cookies and authentication tokens, hijack accounts, or perform administrative actions via Cross-Site Request Forgery (CSRF). This issue specifically affects the default SQLite WebSocket backend configuration.Recommendations
For versions 29.0 and earlier, implement the
removeAutoEvalCodeOnHTMLRecursive() function within MessageSQLite.php to ensure the autoEvalCodeOnHTML parameter is stripped from all nested paths. As a temporary mitigation, restrict access to the WebSocket messaging system to trusted users only.Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Avideo
Wwbn Avideo