Security Advisory

CVE-2026-41061

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2026-04-21 22:49:40

Last updated 2026-04-22 13:14:27

Assigner GitHub_M

State PUBLISHED

Description

WWBN AVideo is an open source video platform. In versions 29.0 and below, the `isValidDuration()` regex at `objects/video.php:918` uses `/^[0-9]{1,2}:[0-9]{1,2}:[0-9]{1,2}/` without a `$` end anchor, allowing arbitrary HTML/JavaScript to be appended after a valid duration prefix. The crafted duration is stored in the database and rendered without HTML escaping via `echo Video::getCleanDuration()` on trending pages, playlist pages, and video gallery thumbnails, resulting in stored cross-site scripting. Commit bcba324644df8b4ed1f891462455f1cd26822a45 contains a fix.

← Browse all CVEs View on cve.org ↗