CVE-2026-89247: WWBN AVideo XML Injection via plugin/AD_Server/VMAP.php
WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier contains an XML injection vulnerability in plugin/ADServer/VMAP.php, which is reachable without authentication when the ADServer plugin is enabled. The script emits Content-Type: application/xml and writes the timeOffset and idTag values returned by ADServer::getVMAPSFromRequest() directly into VMAP attributes without encoding. Those values originate from the base64- and JSON-decoded $REQUEST['vmaps'] parameter, which is not covered by $securityFilter in objects/security.php. A remote attacker can craft a vmaps value (containing a non-empty VAST.campaing entry) and induce a user to open the resulting VMAP URL or a video page using it, injecting arbitrary <vmap:AdBreak> and <vmap:AdTagURI>/AdSource nodes into the generated XML. The player's IMA path (afterVideoJS -> PlayerSkins::setIMAADTag) then requests the attacker-supplied ad URLs, resulting in ad injection and cross-origin requests from the victim's playback session. The issue was unfixed at the time of reporting.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
If the AD_Server plugin is enabled, disable/uninstall it to prevent access to the vulnerable VMAP endpoint (plugin/AD_Server/VMAP.php) in AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier.
- Compensating control
Add/extend input filtering so that the $_REQUEST['vmaps'] parameter (base64/JSON decoded) is covered by the existing $securityFilter in objects/security.php, preventing attacker-controlled VMAP values from reaching the XML attribute generation in plugin/AD_Server/VMAP.php.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
AVideo deployments at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier are exposed when the AD_Server plugin is enabled. The affected VMAP endpoint is reachable without authentication.
What does an attacker need to exploit it?
An attacker only needs to craft a base64- and JSON-encoded vmaps request value containing a non-empty VAST.campaing entry, then induce a user to open the generated VMAP URL or a video page that uses it. No attacker authentication is required, but victim interaction is required.
What is the practical impact on a victim?
The attacker can inject VMAP AdBreak and AdTagURI/AdSource nodes into the XML response. During playback, the IMA integration requests attacker-supplied ad URLs from the victim's session, enabling ad injection and cross-origin requests.
Is there a patch available?
The issue was reported as unfixed. If patching is not immediately possible, disabling the AD_Server plugin removes the stated condition that makes the vulnerable endpoint reachable.