CVE-2026-89246: WWBN AVideo CSV Injection Vulnerability

CVE-2026-89246 Overview

CVE-2026-89246 is a CSV formula injection vulnerability in WWBN AVideo, an open-source video streaming platform. The flaw exists in the myComments.download.php endpoint, which fails to sanitize spreadsheet formula prefix characters submitted through comment text. Authenticated users can embed payloads beginning with =, +, -, or @ into comments. When an administrator or video owner exports and opens the resulting CSV in a spreadsheet application, the injected formulas execute in the victim's context. The issue affects WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 and is tracked under [CWE-1236: Improper Neutralization of Formula Elements in a CSV File].

Critical Impact
Authenticated attackers can plant spreadsheet formulas in comments that execute against administrators or video owners when exported CSV files are opened, enabling data exfiltration or command execution through spreadsheet macros.

Affected Products

WWBN AVideo streaming platform
Builds through commit c3edcc274c389816d434acadac07ee78eaf330c1
Deployments exposing the myComments.download.php export endpoint

Discovery Timeline

2026-09-11 - CVE-2026-89246 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-89246

Vulnerability Analysis

WWBN AVideo exposes an administrative export at myComments.download.php that serializes comment records into a CSV file. The endpoint concatenates user-supplied comment text into CSV cells without neutralizing spreadsheet formula prefixes. Spreadsheet applications such as Microsoft Excel, LibreOffice Calc, and Google Sheets interpret any cell beginning with =, +, -, or @ as a formula. As a result, an attacker with an authenticated comment-posting role can stage a payload that executes later, when a privileged user downloads and opens the report.

Exploitation depends on victim interaction. Once the CSV opens, an injected formula can invoke functions such as HYPERLINK, WEBSERVICE, IMPORTXML, or DDE calls to exfiltrate cell contents, redirect the victim to phishing pages, or launch external programs where legacy Dynamic Data Exchange remains enabled. The attack succeeds even when the AVideo application itself is fully patched at the HTTP layer, because the malicious content is rendered by the downstream spreadsheet client.

Root Cause

The root cause is missing output-side neutralization when generating CSV data. The export routine treats comment strings as opaque text and writes them directly into cell values. It does not prepend a safe character (for example, a single quote or tab), wrap high-risk fields in defensive quoting, or reject prefix characters that spreadsheet parsers treat as executable indicators.

Attack Vector

A registered user submits a comment on any video containing a payload such as =HYPERLINK(...) or =cmd|'/c calc'!A1. The payload persists in the comment store. When an administrator or the affected video owner triggers a CSV export via myComments.download.php and opens the resulting file, the spreadsheet application evaluates the formula. The attack requires low privileges and user interaction on the victim side, and it can be delivered remotely over the network. Detailed reproduction steps are available in the GitHub Security Advisory and the VulnCheck AVideo Vulnerability Advisory.

Detection Methods for CVE-2026-89246

Indicators of Compromise

Comment records in the AVideo database whose text begins with =, +, -, or @, particularly when followed by spreadsheet functions such as HYPERLINK, WEBSERVICE, IMPORTXML, DDE, or cmd.
HTTP access logs showing repeated POSTs to comment endpoints followed by GET /myComments.download.php from administrator sessions.
Outbound DNS or HTTP requests from analyst workstations to unknown domains shortly after opening AVideo CSV exports.

Detection Strategies

Scan stored comment content for regular expressions matching leading formula prefixes and known spreadsheet function names.
Inspect generated CSV artifacts for unquoted cells beginning with formula characters before distributing them to administrators.
Correlate endpoint telemetry on administrator workstations for EXCEL.EXE or soffice.bin spawning child processes such as cmd.exe, powershell.exe, or scripting hosts.

Monitoring Recommendations

Alert on process launches whose parent is a spreadsheet application and whose command line references network utilities or interpreters.
Monitor outbound connections from workstations to non-corporate domains immediately after CSV downloads from AVideo hosts.
Track privileged use of the myComments.download.php endpoint and baseline export frequency to surface anomalies.

How to Mitigate CVE-2026-89246

Immediate Actions Required

Restrict access to myComments.download.php to a minimal set of administrator accounts until a fix is deployed.
Instruct administrators to review AVideo CSV exports in a plain text editor before opening them in a spreadsheet application.
Audit existing comment records for formula prefix characters and quarantine or sanitize suspicious entries.

Patch Information

At the time of publication, the vulnerability is documented against WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1. Operators should track the GitHub Security Advisory for the official remediation commit and upgrade to the fixed release once published. The VulnCheck AVideo Vulnerability Advisory provides additional guidance for maintainers packaging their own builds.

Workarounds

Modify the export routine to prepend a single quote or tab character to any cell value beginning with =, +, -, or @.
Wrap all exported string cells in double quotes and escape embedded quotes to reduce parser ambiguity.
Disable Dynamic Data Exchange (DDE) and external content in spreadsheet applications used by administrators via Group Policy.
Deliver reports in a non-formula format such as JSON or PDF where feasible.

bash

# Configuration example: disable DDE and external content in Microsoft Excel via registry
reg add "HKCU\Software\Microsoft\Office\16.0\Excel\Security" /v WorkbookLinkWarnings /t REG_DWORD /d 2 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Excel\Security" /v DDEAllowed /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Excel\Security" /v DDECleaned /t REG_DWORD /d 1 /f