HTML Injection Vulnerability in WWBN AVideo Open Source Video Platform
CVE-2026-43876

6.4MEDIUM

Key Information:

Vendor

Wwbn

Status
Avideo
Vendor
CVE Published:
11 May 2026

What is CVE-2026-43876?

The vulnerability in WWBN AVideo allows an authenticated user with upload permissions to exploit the system by sending unfiltered HTML content in emails. This occurs in the notifySubscribers.json.php file when the raw POST parameter is used without proper sanitization, leading to potential phishing attacks or unauthorized links being sent to subscribers. Since the emails are sent from the platform's official address and appear legitimate, this poses a significant risk to recipients, as they may unknowingly engage with malicious content. A fix has been implemented in the latest commit, which addresses the issue by incorporating necessary sanitization measures.

Affected Version(s)

AVideo <= 29.0

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-g...
x_refsource_CONFIRM
https://github.com/WWBN/AVideo/commit/078c4342eb9969a7042...
x_refsource_MISC

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.