CVE-2025-61788: Apereo Opencast XSS Vulnerability

CVE-2025-61788 Overview

CVE-2025-61788 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in Apereo Opencast, an open-source platform for managing educational audio and video content. Versions prior to 17.8 and 18.2 render user-controlled metadata such as title and description without sanitization in the Paella player. Authenticated attackers with write access can inject HTML and JavaScript that executes in the browsers of users watching the affected media. The injected script can modify page content or perform actions in the context of logged-in users, including administrators.

Critical Impact
Authenticated attackers with media upload privileges can inject persistent JavaScript that executes in every viewer's browser session, enabling account takeover and session hijacking of higher-privileged users.

Affected Products

Apereo Opencast versions prior to 17.8
Apereo Opencast 18.x versions prior to 18.2
Opencast Paella Player 7 module (engage-paella-player-7)

Discovery Timeline

2025-10-08 - CVE-2025-61788 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-61788

Vulnerability Analysis

The vulnerability resides in Paella player plugins that construct DOM elements by interpolating metadata values directly into HTML template strings. The affected plugins include org.opencast.paella.downloadsPlugin.js and org.opencast.paella.episodesFromSeries.js. Both call createElementWithHtmlText() with template literals that embed unsanitized values such as dcTitle, download stream identifiers, preview URLs, and video identifiers.

Because the metadata originates from user-supplied fields associated with uploaded media, any HTML or <script>-equivalent payload placed in those fields is parsed and executed when the player renders episode lists, series navigation, or download options. Exploitation requires authenticated write access to upload media or modify metadata, which restricts the attacker population but does not prevent lateral escalation against instructors, administrators, or other logged-in viewers.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. Metadata values are concatenated into HTML strings rather than assigned to safe DOM properties such as textContent or href. The patched code separates structure from data by first creating the element skeleton with placeholders, then populating attributes and text through querySelector assignments.

Attack Vector

An authenticated user with media write permissions uploads or edits an episode and inserts a malicious payload into a metadata field such as the title. When any user, including administrators, loads a page rendered by the vulnerable Paella plugins, the script executes under the origin of the Opencast deployment.

javascript

// Patch: modules/engage-paella-player-7/src/plugins/org.opencast.paella.episodesFromSeries.js
// Before (vulnerable): dcTitle and url interpolated directly into HTML
// After (fixed): element is created with empty placeholders, then values are
// assigned via DOM property setters that do not parse HTML.

const elm = createElementWithHtmlText(`
        <li>
            <a href="">
                <img src="" alt="">
                <span> </span>
            </a>
        </li>
        `, list);
elm.querySelector('a').href = url;
elm.querySelector('img').src = preview;
elm.querySelector('img').alt = dcTitle;
elm.querySelector('span').textContent = dcTitle;
// Source: https://github.com/opencast/opencast/commit/2809520fa88d108d8104c760f00c10bad42c14f9

Detection Methods for CVE-2025-61788

Indicators of Compromise

Metadata fields (title, description, series name) containing HTML tags, <script> fragments, on*= event handlers, or javascript: URIs.
Unexpected outbound requests from viewer browsers to attacker-controlled domains when loading episode or series pages.
Audit log entries showing media metadata edits by unusual accounts prior to reports of session anomalies.

Detection Strategies

Review Opencast database and API responses for stored metadata values containing HTML control characters or scripting constructs.
Deploy Content Security Policy (CSP) reporting to surface inline script violations originating from the Paella player context.
Correlate metadata modification events with subsequent anomalous authenticated actions from viewing users.

Monitoring Recommendations

Enable and centralize Opencast administrative and API audit logs to track metadata write operations.
Alert on new or modified media where metadata fields contain angle brackets, quotes, or URL schemes other than http/https.
Monitor browser telemetry for JavaScript errors or unexpected DOM modifications on watch.html and series listing pages.

How to Mitigate CVE-2025-61788

Immediate Actions Required

Upgrade Opencast to version 17.8 or 18.2 or later, which include the sanitization fix from commit 2809520fa88d108d8104c760f00c10bad42c14f9.
Audit existing media metadata for injected HTML or JavaScript payloads and remove or sanitize offending entries.
Review the accounts holding media upload and metadata edit permissions and revoke privileges that are not required.

Patch Information

The fix is available in Opencast 17.8 and 18.2. The patch rewrites vulnerable Paella player plugins to assign metadata through safe DOM properties (textContent, href, src, alt) instead of interpolating values into HTML template strings. See the GitHub Security Advisory GHSA-m2vg-rmq6-p62r and the upstream fix commit.

Workarounds

Restrict write access so that only trusted users can upload media or edit metadata until the upgrade is applied.
Deploy a strict Content Security Policy that disallows inline scripts and untrusted script sources for the Paella player origin.
Front the Opencast deployment with a reverse proxy or web application firewall rule that blocks HTML tags in metadata submission endpoints.

bash

# Example: verify installed Opencast version and upgrade path
curl -s -u admin:PASSWORD https://opencast.example.org/sysinfo/bundles/version | jq .

# Recommended: upgrade to a fixed release
# - Opencast 17.8 (17.x branch)
# - Opencast 18.2 (18.x branch)