AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability

Published September 11, 2026 CVE-2026-89254

A malicious AVideo administrator can plant a script that runs in visitors' browsers. The script can expose or change information available through AVideo.

Severity
HighCVSS 3.1 · 8.7 · vulncheck.com
Fix
Release fix not confirmedSource revisions listed; check the advisory
Weakness
CWE-79Cross-site Scripting (XSS)
Affects
AVideo
Exploited
Not confirmedNo confirmation recorded
CISA SSVC
No known exploitationAutomatable: no · Technical impact: partial
EU ID
EUVD-2026-76066ENISA vulnerability database

How it works

  • An attacker first needs administrator access to the affected AVideo feature.
  • They submit a crafted name for an extra profile field.
  • AVideo stores that name without making it safe for a web page.
  • The planted script runs when an administrator views extra information.
  • Profile forms can also trigger it when extra information is enabled.

What to do

If you administer AVideo, compare your deployed commit with c3edcc274c389816d434acadac07ee78eaf330c1 in the vendor advisory. Check whether the CustomizeUser plugin is installed. Treat deployments at or before that commit as affected.

Check the vendor advisory for a documented fix or mitigation. It listed no fixed version when published. Compare any replacement commit with the advisory's affected cutoff before treating the deployment as fixed.

Technical details

CVE-2026-89254 is stored cross-site scripting in AVideo's CustomizeUser plugin. The field_name value is stored raw and inserted into labels and placeholders. A stored script executes under the AVideo site's identity when affected pages render it. The affected range ends at commit c3edcc274c389816d434acadac07ee78eaf330c1.

The vendor advisory listed the issue as unfixed when published.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required Low Attacker needs a basic user account
  • User interaction Required Requires another user to take an action
  • Scope Changed Impact crosses a security authority boundary
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact None No availability impact
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N Open in FIRST.org calculator

References

View Original Source