CVE-2026-105086: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in WWBN AVideo

CVE-2026-105086 is a stored cross-site scripting vulnerability in WWBN AVideo affecting versions 12.4 through 29.2.0. Authenticated users with uploader privileges can exploit this by submitting video titles containing doubly-encoded HTML entities. The safeString() function, which is intended to sanitize input, first strips tags before decoding entities and is invoked twice via setTitle() and save(), enabling attackers to bypass sanitization and store executable HTML markup. This stored markup executes in multiple user-facing pages such as trending, gallery, embed, and playlist, potentially leading to high-impact client-side attacks.

The vulnerability allows authenticated uploaders to inject and store malicious HTML that executes in various parts of the application visible to other users. This can lead to cross-site scripting attacks with high impact, including theft of user credentials, session hijacking, or other malicious actions executed in the context of affected users. The CVSS 4.0 score of 9.3 reflects the critical severity and the ease of exploitation with low attack complexity and no privileges beyond uploader access.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict uploader privileges to trusted users only and consider additional input validation or sanitization controls on video titles to prevent injection of doubly-encoded entities.