CVE-2026-89244 Overview
CVE-2026-89244 is a reflected cross-site scripting (XSS) vulnerability in WWBN AVideo, an open-source video streaming platform. The flaw exists in plugin/Gallery/view/Category.php when the SubCategorys option is enabled. The getBackURL parameter is echoed into an href attribute without HTML encoding, allowing script injection. The vulnerability affects AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1. Attackers craft a malicious URL and trick users into clicking the Back control, at which point injected JavaScript executes in the victim's browser session. The issue is tracked under CWE-79 and disclosed via a GitHub Security Advisory and a VulnCheck Advisory on XSS.
Critical Impact
Attackers can execute arbitrary JavaScript in the browsers of authenticated AVideo users, enabling session theft, credential harvesting, and unauthorized actions performed on behalf of the victim.
Affected Products
- WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1
- AVideo Gallery plugin with SubCategorys enabled
- plugin/Gallery/view/Category.php component
Discovery Timeline
- 2026-09-11 - CVE-2026-89244 published to the National Vulnerability Database
- 2026-09-11 - Last updated in NVD database
Technical Details for CVE-2026-89244
Vulnerability Analysis
The vulnerability resides in the Gallery plugin's category view logic. When SubCategorys mode is enabled, the application constructs a Back navigation link using the getBackURL query parameter supplied by the client. The parameter value is inserted directly into an href attribute of the rendered HTML without being passed through an HTML encoding routine such as htmlspecialchars(). An attacker who controls the URL contents can break out of the attribute context and inject arbitrary JavaScript or attribute-based event handlers. Because the injection occurs in a link the user is expected to interact with, exploitation requires user interaction (activating the Back control). Successful exploitation runs script in the same origin as the AVideo application, exposing session cookies, CSRF tokens, and any authenticated APIs the victim can reach. The flaw is classified as CWE-79: Improper Neutralization of Input During Web Page Generation.
Root Cause
The root cause is missing output encoding on user-controlled input inserted into an HTML attribute. The Category.php template concatenates the raw getBackURL value into markup rather than encoding it for the HTML attribute context. This bypasses browser-level XSS auditors when the payload uses javascript: URIs or attribute-terminating sequences.
Attack Vector
Exploitation is network-based and requires no authentication or elevated privileges. An attacker builds a URL targeting a vulnerable AVideo installation with SubCategorys enabled and supplies a crafted getBackURL value containing a javascript: scheme or an attribute-breaking payload. The attacker delivers the link through phishing email, chat, or a third-party website. When the victim visits the page and clicks the Back control, the injected script executes under the AVideo origin. See the VulnCheck Advisory on XSS for reproduction details.
No verified proof-of-concept code is published in the enriched advisory data. Refer to the GitHub Security Advisory for the vendor's technical description.
Detection Methods for CVE-2026-89244
Indicators of Compromise
- Web server access logs containing requests to plugin/Gallery/view/Category.php with unusual getBackURL values including javascript:, <script, onerror=, or URL-encoded equivalents such as %3Cscript%3E.
- Referer headers pointing to attacker-controlled domains that redirected users to the AVideo gallery.
- Unexpected outbound requests from user browsers to unknown domains shortly after visiting a gallery category page.
Detection Strategies
- Deploy a web application firewall (WAF) rule that inspects the getBackURL parameter for HTML metacharacters and script-URI schemes.
- Enable server-side logging of query strings on the Gallery endpoint and alert on payloads containing angle brackets, event handlers, or encoded script tags.
- Perform authenticated dynamic application security testing (DAST) against AVideo instances with SubCategorys enabled to identify reflection points.
Monitoring Recommendations
- Monitor for anomalous spikes in traffic to plugin/Gallery/view/Category.php containing long or encoded getBackURL values.
- Correlate suspicious gallery requests with subsequent session anomalies, such as new IP addresses using the same session cookie.
- Ingest AVideo web logs into a SIEM platform and alert on XSS-indicative patterns using OCSF-normalized HTTP activity events.
How to Mitigate CVE-2026-89244
Immediate Actions Required
- Upgrade WWBN AVideo to a commit later than c3edcc274c389816d434acadac07ee78eaf330c1 that includes the fix referenced in the GitHub Security Advisory.
- Disable the Gallery plugin's SubCategorys option until patching is complete if the feature is not required.
- Deploy a WAF rule to filter getBackURL values containing HTML metacharacters or javascript: schemes.
- Rotate active user session cookies after patching to invalidate any tokens potentially exposed by exploitation.
Patch Information
WWBN has published remediation guidance in the GitHub Security Advisory GHSA-j2r3-gr47-rgfm. Administrators should pull the latest AVideo source from the official repository and redeploy. Verify the fix by inspecting plugin/Gallery/view/Category.php to confirm that getBackURL is passed through an HTML attribute encoder before being echoed.
Workarounds
- Disable the Gallery plugin entirely if it is not in production use.
- Configure SubCategorys to disabled state in the Gallery plugin settings to remove the vulnerable code path.
- Enforce a strict Content Security Policy (CSP) that blocks inline scripts and javascript: URIs to reduce exploitation impact.
- Educate users to avoid clicking gallery links received from untrusted sources.
# Example CSP header to mitigate reflected XSS impact
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
