Executive brief
WWBN AVideo is a video hosting and management platform. A cross-site request forgery vulnerability in the video editing component allows attackers to change video ownership and metadata (title, description, category, thumbnail) without administrative action. An attacker can store a malicious image tag in a video description; when an administrator views that video page, the attack executes automatically, transferring the video to an attacker-controlled account.
Technical details
The vulnerability is a cross-site request forgery (CWE-352) in objects/videoEditLight.php, which lacks request authenticity checks (no CSRF tokens, no forbidIfIsUntrustedRequest() call) and accepts GET requests despite performing state-changing operations. The file reads directly from $_REQUEST and calls Video::canEdit() before modifying video ownership via setUsers_id(), title, description, and other fields. The attack vector is stored XSS: HTMLPurifier permits <img> tags in video descriptions, and these render on the public video page, triggering an automatic GET request to videoEditLight.php on page load. An ordinary account (PR:L) can plant the payload, and an administrator viewing the page (UI:R) triggers the attack; no user interaction beyond navigation is required. Patched versions are not yet available as of the advisory date.
Affected products
- WWBN AVideo through commit 9c39d8c8
Timeline
- 2026-08-22: disclosed
- 2026-08-07: advisory: GitHub Security Advisory GHSA-7mqw-mqc3-ffjw published