CVE-2026-85158: AVideo Reflected XSS via videoEmbeded.php link parameter
AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in videoEmbeded.php that echoes the link parameter inside an HTML comment with zero escaping. Attackers can close the comment with --> and inject arbitrary JavaScript that executes when victims visit the crafted embed URL.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker needs to craft an embed URL whose link parameter closes the HTML comment and injects JavaScript, then convince a victim to visit that URL. No authentication is required, but victim interaction is required.
Who is exposed?
Users who visit attacker-controlled or attacker-supplied AVideo videoEmbeded.php embed URLs are exposed. The injected JavaScript executes in the victim's browser in the context of the affected AVideo site.
How can I determine whether my instance is affected?
Check whether your deployed AVideo code includes videoEmbeded.php behavior that outputs the link parameter inside an HTML comment without escaping. The issue is described as affecting AVideo through commit c91b5975d.