CVE-2026-89249

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 is vulnerable to stored cross-site scripting (CWE-79) in the YPTWallet plugin, where user-supplied CryptoWallet values are base64-encoded but never HTML-escaped before being stored in wallet_log.information. The injected markup executes when an administrator opens the pending withdrawal requests view (pendingRequests.php), meaning a low-privileged user can trigger the payload simply by submitting a withdrawal request with crafted wallet data. Because the script runs in the admin's same-origin session, an attacker can issue administrative actions such as creating users or changing settings via fetch requests. Any AVideo deployment with the YPTWallet plugin enabled is affected; there is no known public proof-of-concept, the flaw is not listed in CISA KEV, and no in-the-wild exploitation has been reported.

What to do: Update AVideo to a revision newer than commit c3edcc274c389816d434acadac07ee78eaf330c1, ensuring the YPTWallet plugin escape fix is included. As interim mitigation, restrict which users may set CryptoWallet values and have administrators avoid pendingRequests.php until patched, and review wallet_log.information entries for injected HTML. No specific patched release version is provided in the disclosure data.