CVE-2026-88867

WWBN AVideo, in versions up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1, stores the 'name' and 'iconClass' values submitted to objects/categoryAddNew.json.php without sanitization (the name is only truncated to 45 characters), resulting in a stored cross-site scripting flaw (CWE-79) rated critical at CVSS 4.0 9.3. When the CustomizeUser option usersCanCreateNewCategories is enabled, any authenticated user with canUpload permission, which is granted by default via self-registration, can create a category containing a JavaScript payload that executes in the browser of any visitor who views a watch page or gallery entry for a video assigned to that category. Because these pages are also viewed by administrators, an attacker can run script under an admin's session and perform authenticated actions on the victim's behalf, such as content or configuration changes. All self-hosted AVideo deployments with user-created categories enabled are affected. The flaw was unpatched at the time of reporting, with no public proof-of-concept, no CISA KEV listing, and no confirmed in-the-wild exploitation.

What to do: No fixed release was available as of the reported commit, so upgrade as soon as a patched AVideo version is published and monitor the upstream repository for the fix. In the meantime, disable usersCanCreateNewCategories under CustomizeUser or restrict category creation to trusted administrators, and audit existing categories for injected HTML/JavaScript in the name and iconClass fields. Defenders should also ensure the category name and iconClass are HTML-encoded on output in view/modeYoutubeBottom.php and plugin/Gallery/functions.php.