Input Validation Issue in a2ui Image Player, Video Player, and Audio Player
CVE-2026-118537

5.3MEDIUM

Key Information:

Vendor

a2ui-project

Status
A2ui
Vendor
CVE Published:
28 October 2026

What is CVE-2026-118537?

The a2ui software, specifically its Image Player, Video Player, and Audio Player components, is vulnerable due to improper input validation in the Image.js file. This vulnerability allows an attacker to manipulate the 'url' argument, potentially leading to unauthorized actions or access. The issues can be exploited remotely, putting users at risk. A fix for this vulnerability is currently pending approval through a pull request.

Affected Version(s)

a2ui 0.10.0

a2ui 0.10.1

a2ui 0.10.2

References

https://vuldb.com/vuln/428014
vdb-entrytechnical-description
https://vuldb.com/vuln/428014/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-118537
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

ez-lbz (VulDB User)
VulDB CNA Team
.