CVE-2026-89246: WWBN AVideo CSV Formula Injection via myComments.download.php

Published Sep 11, 2026

Updated

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a CSV formula injection vulnerability in the myComments.download.php endpoint that fails to sanitize spreadsheet formula prefixes in comment text. Authenticated users can inject formulas starting with =, +, -, or @ characters that execute when administrators or video owners open the exported CSV file in spreadsheet applications.

Affected Software

1 affected component

AVideo=

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WWBN AVideo to a version that resolves this vulnerability.
Patch c3edcc274c389816d434acadac07ee78eaf330c1

Event History

Sep 11, 2026

CVE Published

via MITRE·11:15 AM

Data Sourced

via MITRE·11:15 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Administrators and video owners are exposed when they open CSV files exported from the affected comments endpoint in a spreadsheet application. The attacker must be an authenticated user able to submit comment text.

What does an attacker need to do to exploit it?

The attacker needs to place a spreadsheet formula prefix such as =, +, -, or @ at the start of comment text. Exploitation occurs only when a recipient opens the resulting exported CSV in a spreadsheet application.

Is user interaction required?

Yes. An administrator or video owner must export and open the CSV file in a spreadsheet application for the injected formula to execute.