Executive brief
A vulnerability in the AVideo Scheduler plugin allows unauthenticated attackers to create fraudulent calendar invitations. By tricking a user into downloading a specially crafted calendar file from the trusted AVideo server, an attacker can inject fake meetings, phishing links, or malicious instructions directly into the user's personal calendar. This can be used for highly credible phishing attacks because the file originates from a trusted corporate or media streaming domain.
Technical details
The 'plugin/Scheduler/downloadICS.php' endpoint in AVideo (up to version 29.0) is vulnerable to CRLF injection because it fails to sanitize carriage return and line feed characters in the 'title', 'description', and 'joinURL' parameters. These parameters are passed to the 'ICS' helper class, where 'ICS::escape_string()' only escapes commas and semicolons. An unauthenticated attacker can inject 'BEGIN:VEVENT' and 'END:VEVENT' sequences to define arbitrary additional calendar events within the generated .ics file. When a victim imports this file, the injected events (including malicious URLs and descriptions) are added to their calendar. A fix involves updating 'objects/ICS.php' to properly encode newlines as '\\n' per RFC 5545.
Affected products
- WWBN AVideo (formerly YouPHPTube) <= 29.0
Timeline
- 2026-04-27: disclosed: Initial report to vendor
- 2026-05-05: advisory: GitHub Advisory published
- 2026-05-11: kev added: NVD publication date