Executive brief
WWBN AVideo is an open-source video streaming platform. A security flaw in its Electronic Program Guide (EPG) allows users with basic upload permissions to inject malicious scripts into the platform. When other people, including administrators, view the public program guide, these scripts can run automatically in their browsers, potentially allowing attackers to hijack sessions and take over accounts.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in WWBN AVideo versions 26.0 and prior due to improper neutralization of input in the Electronic Program Guide (EPG) feature. The application fetches XML data from a user-provided URL (epg_link) and extracts program titles in 'objects/EpgParser.php' without sanitization. These titles are then directly interpolated into HTML output in 'plugin/PlayerSkins/epg.php'. An attacker with 'upload' privileges can provide a link to a malicious XML file containing JavaScript in the <title> tags. Because the EPG page is publicly accessible and the output is cached server-side, the script executes in the context of any visitor's browser, including unauthenticated users and administrators. This can lead to session hijacking via cookie exfiltration. A patch has been committed to escape program titles using htmlspecialchars().
Affected products
- WWBN AVideo <= 26.0
Timeline
- 2026-04-06: advisory: GitHub Security Advisory GHSA-rqp3-gf5h-mrqx published
- 2026-04-07: disclosed: CVE-2026-39367 published
- 2026-04-07: patched: Fix committed to repository