CVE-2026-105086: WWBN AVideo Stored XSS Vulnerability

CVE-2026-105086 Overview

CVE-2026-105086 is a stored cross-site scripting ([CWE-79]) vulnerability in WWBN AVideo versions 12.4 through 29.2.0. Authenticated users with upload privileges can inject HTML by submitting doubly-encoded entities in video titles. The safeString() function strips tags before decoding entities, and runs twice via setTitle() and save(), allowing attackers to store executable markup. The payload executes when victims view trending, gallery, embed, and playlist pages that render the stored title.

Critical Impact
An authenticated uploader can store HTML that executes in any viewer's browser across multiple high-traffic pages, enabling session theft, account takeover, and further client-side attacks.

Affected Products

WWBN AVideo 12.4 through 29.2.0
Trending, gallery, embed, and playlist rendering components
Video title and description handling in objects/functions.php and objects/video.php

Discovery Timeline

2026-10-04 - CVE-2026-105086 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105086

Vulnerability Analysis

The vulnerability lives in AVideo's safeString() sanitizer and the order in which it processes untrusted input. The function removes HTML tags first, then calls html_entity_decode() to decode numeric and named entities. When an attacker submits a doubly-encoded payload such as &<lt;script&>gt;, the initial strip_tags() sees no tags because the markup is still entity-encoded. The subsequent decode step reconstructs the raw <script> tags into the stored value.

The issue is amplified because safeString() runs twice on the same input. setTitle() invokes it once, and the save() method in objects/video.php invokes it again. Each pass decodes one layer of encoding, producing executable HTML that is then persisted to the database and rendered on trending, gallery, embed, and playlist pages.

Root Cause

The sanitizer ordering violates the standard rule of decoding before filtering. By stripping tags prior to entity decoding, safeString() leaves nested encodings intact and later converts them into live markup. Running the function twice compounds the flaw and defeats single-layer encoding assumptions.

Attack Vector

An attacker needs authenticated access with upload rights. They submit a video with a title containing nested HTML entities. The server stores the decoded markup, and any user who visits a page that renders the title triggers script execution in their browser session.

php

// Security patch applied in objects/functions.php
$text = preg_replace('/(&#*\w+)[\\x00-\\x20]+;/u', '', $text);
$text = preg_replace('/(&#x*[0-9A-F]+);*/iu', '', $text);
$text = html_entity_decode($text, ENT_COMPAT, 'UTF-8');
// decoding can turn nested entities (e.g. &&lt;lt;) into real tags, strip them again
$text = strip_tags($text);

if ($strict) {
    $text = filter_var($text, FILTER_SANITIZE_FULL_SPECIAL_CHARS);

Source: GitHub AVideo Commit c4b6ca9

php

// Second sanitization pass hardened in objects/video.php
$this->title = ((safeString($this->title)));
// same quote handling as setTitle(): this second safeString() pass can decode " into a raw quote
$this->title = str_replace(['"', "\\"], ["''", ""], $this->title);
$this->description = (($this->description));

Source: GitHub AVideo Commit c4b6ca9

Detection Methods for CVE-2026-105086

Indicators of Compromise

Video titles or descriptions in the database containing <script, onerror=, onload=, or javascript: after decoding.
Stored titles containing nested or doubly-encoded entities such as &<, <, or <.
Outbound requests from viewer browsers to attacker-controlled domains following visits to trending, gallery, embed, or playlist pages.

Detection Strategies

Query the videos table for titles and descriptions matching regex patterns for HTML entities followed by tag-like characters.
Enable Content Security Policy (CSP) reporting to capture inline script execution attempts originating from AVideo pages.
Review web server logs for POST requests to video upload and update endpoints submitted by low-privilege accounts.

Monitoring Recommendations

Alert on uploader accounts that submit titles containing & sequences followed by alphanumeric entity names.
Monitor browser-side errors and CSP violations tied to AVideo frontend routes.
Audit newly created uploader accounts and correlate their uploads with CSP violation spikes.

How to Mitigate CVE-2026-105086

Immediate Actions Required

Upgrade WWBN AVideo to the version containing commit c4b6ca95a0ae3efa09919a98879870086cff150e or later.
Audit existing video titles and descriptions for stored HTML and remove or re-sanitize matching records.
Restrict uploader privileges to trusted accounts until the patch is applied.

Patch Information

The fix is published in the GitHub Security Advisory GHSA-q62w-927x-vhhf and applied in commit c4b6ca9. The patch adds a second strip_tags() call after html_entity_decode() in safeString() and hardens the double-sanitization behavior in objects/video.php. Additional context is available in the VulnCheck AVideo Advisory.

Workarounds

Deploy a web application firewall rule that blocks video title and description inputs containing doubly-encoded HTML entities.
Enforce a strict Content Security Policy that disallows inline scripts on trending, gallery, embed, and playlist pages.
Temporarily disable public uploads or require manual review of new video metadata until the patched release is deployed.

bash

# Example ModSecurity rule to block doubly-encoded entities in video title fields
SecRule ARGS:title "@rx (&(amp;)?#?x?[0-9a-fA-F]+;?){2,}" \
    "id:1050860,phase:2,deny,status:403,log,msg:'Blocked double-encoded entity in AVideo title (CVE-2026-105086)'"