UpHeron
All vulnerabilities

Servers and applications

GHSA-2qxw-wm6h-5jr7

Stored XSS: a registered user's channel About text is entity-decoded by feedHtmlDescription() and rendered unescaped by feed/rss-style.xsl (disable-output-escaping), so the public channel RSS page /channel/<name>/feed runs script on the site origin

Severity
Medium 5.4
Published
11 Nov 2026
Last changed
11 Nov 2026
Added to UpHeron
11 Nov 2026
Weakness
Cross-site scripting (CWE-79)
Attack
Over the network · Needs a user account · Needs someone to click or open something
Attacker can
Read some data · Change some data
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Sources
Project advisories (GitHub)

Description

Any registered user can store an XSS payload in their channel About field. The payload runs in the browser of anyone who opens that user's public channel feed (/channel//feed). The feed page is served from the AVideo origin, and the RSS button on the channel page links to it.

User::setAbout() stores the About text HTML-escaped (xss_esc()), for example <img src=x onerror=...>. Three things undo that escaping:

  • feed/index.php copies the About text into the channel .
  • feedHtmlDescription() (feed/index.php:143) calls html_entity_decode() up to three times, so the stored entities become a real tag. Its own filters do not remove it. The on*= regex only matches quoted values ("..." / '...'), so onerror=alert(1) with no quotes and pass, and javascript: URLs are never checked.
  • The response is text/xml with <?xml-stylesheet href=".../feed/rss-style.xsl"?>. rss-style.xsl prints description with disable-output-escaping="yes" (lines 32 and 41).
From WWBN/AVideo's security advisory. Shortened; the full text is there.

Affected software

SoftwareAffected versions
AVideoServers and applications · github:wwbn/avideo
  • From 29.1.0 up to 29.7.1

References