Injection Vulnerability in WWBN AVideo's ICS Calendar File Creation

CVE-2026-43882

What is CVE-2026-43882?

The WWBN AVideo open-source video platform has a significant vulnerability in its ICS calendar file generation. In versions up to 29.0, the unauthenticated endpoint for generating calendar files incorrectly handles input parameters like title, description, and joinURL. Due to inadequate escaping of CR/LF characters, an attacker can inject malicious ICS lines into the calendar file. This flaw allows the attacker to craft and serve a fraudulent ICS file, resulting in the victim unknowingly adding bogus calendar events that can lead to effective phishing attempts. These events can contain arbitrary details such as meeting summaries, URLs, and locations, creating a façade of legitimacy from the trusted AVideo source. An update has been released to address this vulnerability.

References