UpHeron
All vulnerabilities

Servers and applications

GHSA-2qq6-qfcq-jmr9

Stored XSS in video Source tags allows uploader-to-admin privilege escalation

Severity
High 8.7
Published
11 Nov 2026
Last changed
11 Nov 2026
Added to UpHeron
11 Nov 2026
Weakness
Cross-site scripting (CWE-79)
Attack
Over the network · Needs a user account · Needs someone to click or open something
Attacker can
Read data · Change data
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Sources
Project advisories (GitHub)

Description

objects/aVideoEncoder.json.php calls inputToRequest() at line 36. This happens after videos/configuration.php has already run the global request filter in objects/security.php. inputToRequest() (objects/functions.php:7603-7617) json-decodes php://input and copies every key that is not yet in $_REQUEST into $_REQUEST without filtering it. videoDownloadedLink is on the $securityFilter list (objects/security.php:4, filter at :140-144), so a form-encoded value is HTML-escaped. The same field sent in an application/json body is stored raw.

The receiver stores it with Video::setVideoDownloadedLink() (objects/aVideoEncoder.json.php:239 -> objects/video.php:3699-3703), which does no validation. getVideoTagsSource() (objects/functionTags.php:198-221) later turns the stored URL into a "Source" tag whose text is parse_url($url)['host']. PHP's parse_url() accepts <, >, spaces, =, (, ) and quotes in the host.

From WWBN/AVideo's security advisory. Shortened; the full text is there.

Affected software

SoftwareAffected versions
AVideoServers and applications · github:wwbn/avideo
  • From 14.3 up to 29.7.1

References