Executive brief
WWBN AVideo is a video hosting and streaming platform. A CSV formula injection vulnerability in the comment export feature allows authenticated users to inject malicious spreadsheet formulas that execute when administrators or video owners open the exported CSV file in applications like Excel or LibreOffice, potentially leading to arbitrary command execution on their systems.
Technical details
The vulnerability is a CSV formula injection (CWE-1236) in the myComments.download.php endpoint. User-supplied comment text is written unsanitized into CSV exports using fputcsv() without neutralizing spreadsheet formula prefixes (=, +, -, @). An authenticated user can inject formulas such as =cmd|'/C calc'!A0 in comments. When an administrator or video owner exports comments as CSV and opens it in a spreadsheet application, the formula is interpreted and executed. The xss_esc() sanitization applied to comments only handles HTML entities, not CSV formula prefixes. Exploitation requires authentication and user interaction (opening the CSV file in a spreadsheet). The attack can result in arbitrary command execution in the context of the user opening the file.
Affected products
- WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1
Timeline
- 2026-08-27: disclosed: GitHub Security Advisory GHSA-766f-9gfh-v4wj published
- 2026-09-11: advisory: CVE-2026-89246 published on NVD