CVE-2026-41061
CVE-2026-41061 · WWBN AVideo Vulnerable to stored XSS via Unanchored Duration Regex in Video Encoder Receiver
This page contains facts from public vulnerability sources. Check the original advisory before updating.
WWBN AVideo is an open source video platform. In versions 29.0 and below, the `isValidDuration()` regex at `objects/video.php:918` uses `/^[0-9]{1,2}:[0-9]{1,2}:[0-9]{1,2}/` without a `$` end anchor, allowing arbitrary HTML/JavaScript to be appended after a valid duration prefix. The crafted duration is stored in the database and rendered without HTML escaping via `echo Video::getCleanDuration()` on trending pages, playlist pages, and video gallery thumbnails, resulting in stored cross-site scripting. Commit bcba324644df8b4ed1f891462455f1cd26822a45 contains a fix.
CVSS 5.4 · Medium · EPSS 0.2%
- Published
- Updated
Stack: php
Affected products and versions
avideo
- Versions
- <= 29.0: Affected
No fix published
wwbn/avideo Packagist
- Versions
- 10.4
- 10.8
- 11
- 11.1
- 11.1.1
- 11.5
- 11.6
- 12.4
- 14.3
- 14.3.1
- 14.4
- 18.0
- 21.0
- 22.0
- 24.0
- 25.0
- 26.0
- 29.0
- Affected ranges
- ECOSYSTEM: ≤ 29.0
No fix published