CVE-2026-43882: WWBN AVideo XSS Vulnerability

CVE-2026-43882 Overview

CVE-2026-43882 is a CRLF (Carriage Return / Line Feed) injection vulnerability in WWBN AVideo, an open source video platform. The flaw affects all versions up to and including 29.0. The unauthenticated plugin/Scheduler/downloadICS.php endpoint accepts attacker-controlled title, description, and joinURL parameters and passes them to Scheduler::downloadICS(). The ICS::escape_string() helper escapes only commas and semicolons, leaving CR/LF bytes intact. Attackers exploit this to inject arbitrary ICS calendar properties and entire forged events into the generated .ics file.

Critical Impact

Because the malicious .ics file is served from the trusted AVideo origin, victims who import it see attacker-chosen meetings, URLs, and locations in their calendar — enabling high-credibility calendar phishing.

Affected Products

• WWBN AVideo versions up to and including 29.0
• AVideo Scheduler plugin (plugin/Scheduler/downloadICS.php)
• AVideo ICS helper class (objects/ICS.php)

Discovery Timeline

• 2026-05-11 - CVE-2026-43882 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-43882

Vulnerability Analysis

The vulnerability is a CRLF injection flaw classified under [CWE-93] (Improper Neutralization of CRLF Sequences). AVideo's Scheduler plugin exposes an unauthenticated endpoint at plugin/Scheduler/downloadICS.php that generates RFC 5545 calendar files on demand. Three user-supplied parameters — title, description, and joinURL — are forwarded directly to Scheduler::downloadICS(), which constructs the ICS file using the ICS helper class.

The escape_string() method at objects/ICS.php:167-169 performs incomplete sanitization. It escapes only comma (,) and semicolon (;) characters, the field separators defined by the ICS specification. Carriage return and line feed bytes are not neutralized. ICS uses CRLF as the line terminator between properties, so any unescaped \r\n sequence inside a property value breaks out of that value and begins a new property line.

An attacker who supplies a crafted title containing END:VEVENT\r\nBEGIN:VEVENT\r\n... can terminate the legitimate event and inject an entirely attacker-controlled event with arbitrary SUMMARY, URL, LOCATION, and DESCRIPTION fields. The file is served from the victim's trusted AVideo domain, lending phishing payloads strong perceived authenticity.

Root Cause

The root cause is incomplete input neutralization in ICS::escape_string(). The function addresses ICS field delimiters but ignores the line-terminator characters that define record boundaries in the format. Trust is placed in attacker-controlled query parameters that flow unfiltered into a structured output format.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker crafts a URL to plugin/Scheduler/downloadICS.php containing CRLF sequences inside the title, description, or joinURL parameters. The victim clicks the link, downloads the .ics file, and imports it into a calendar client such as Outlook, Google Calendar, or Apple Calendar. The injected events then appear as legitimate meetings hosted by the AVideo domain.

// Vulnerable pattern in objects/ICS.php (lines 167-169)
// escape_string() escapes only , and ; — CR/LF pass through unchanged
private function escape_string($str) {
    return preg_replace('/([\,;])/', '\\\$1', $str);
}

// Patched in commit 764db592f99e545aa86bb9a4ad664ffd14c38ba5
// Source: https://github.com/WWBN/AVideo/commit/764db592f99e545aa86bb9a4ad664ffd14c38ba5

Detection Methods for CVE-2026-43882

Indicators of Compromise

• HTTP requests to plugin/Scheduler/downloadICS.php containing URL-encoded CRLF sequences (%0D%0A, %0A, or %0D) in title, description, or joinURL parameters.
• Generated .ics files containing multiple BEGIN:VEVENT / END:VEVENT blocks where the Scheduler is expected to emit a single event.
• Outbound calendar invites referencing the AVideo domain with URL or LOCATION properties pointing to unrelated external hosts.

Detection Strategies

• Inspect web server access logs for query strings to the Scheduler endpoint that contain encoded line terminators or the literal strings BEGIN:VEVENT and END:VEVENT.
• Apply a Web Application Firewall (WAF) rule that blocks requests to /plugin/Scheduler/downloadICS.php containing %0A or %0D in any parameter.
• Parse generated .ics responses egressing the server and alert on responses containing more VEVENT blocks than expected.

Monitoring Recommendations

• Monitor mail and proxy gateways for inbound .ics attachments originating from internal AVideo hosts that contain anomalous SUMMARY or URL fields.
• Correlate user calendar-import telemetry with referrer URLs pointing to the Scheduler endpoint.
• Track upstream changes to the AVideo repository for additional Scheduler-related advisories.

How to Mitigate CVE-2026-43882

Immediate Actions Required

• Update AVideo to a release that includes commit 764db592f99e545aa86bb9a4ad664ffd14c38ba5, which contains the corrected ICS escaping logic.
• If patching is not immediately possible, disable or restrict the Scheduler plugin and block public access to plugin/Scheduler/downloadICS.php.
• Audit recent web logs for exploitation attempts and notify users who may have downloaded forged calendar files.

Patch Information

The fix is published in the upstream repository. See the GitHub Commit Log and the GitHub Security Advisory GHSA-mwgh-92m2-wvhv for full remediation details. The patch updates ICS::escape_string() to neutralize CR/LF bytes in addition to commas and semicolons.

Workarounds

• Place a WAF rule in front of AVideo that rejects requests to the Scheduler endpoint containing %0A, %0D, \r, or \n in any query parameter.
• Restrict access to the Scheduler plugin to authenticated users via reverse-proxy ACLs until the patch is applied.
• Educate users to verify the source of unsolicited .ics invitations, even when served from internal domains.

# Example nginx rule blocking CRLF in Scheduler parameters
location = /plugin/Scheduler/downloadICS.php {
    if ($args ~* "(%0A|%0D|\r|\n)") {
        return 403;
    }
}