CVE-2026-41061: WWBN AVideo Vulnerable to stored XSS via Unanchored Duration Regex in Video Encoder Receiver
WWBN AVideo is an open source video platform. In versions 29.0 and below, the isValidDuration() regex at objects/video.php:918 uses /^[0-9]{1,2}:[0-9]{1,2}:[0-9]{1,2}/ without a $ end anchor, allowing arbitrary HTML/JavaScript to be appended after a valid duration prefix. The crafted duration is stored in the database and rendered without HTML escaping via echo Video::getCleanDuration() on trending pages, playlist pages, and video gallery thumbnails, resulting in stored cross-site scripting. Commit bcba324644df8b4ed1f891462455f1cd26822a45 contains a fix.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41061?
CVE-2026-41061 has a medium severity rating due to its potential for stored XSS vulnerabilities.
How do I fix CVE-2026-41061?
To fix CVE-2026-41061, update to a version of WWBN AVideo above 29.0 where the duration regex is properly anchored.
What versions of WWBN AVideo are affected by CVE-2026-41061?
CVE-2026-41061 affects WWBN AVideo versions 29.0 and below.
What type of vulnerability is CVE-2026-41061?
CVE-2026-41061 is classified as a stored cross-site scripting (XSS) vulnerability.
Where can I find more information about CVE-2026-41061?
You can find more information about CVE-2026-41061 in the security advisories published by WWBN.