CVE-2026-89253: AVideo Stored XSS via donationLink in watch page button
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the user 'donationLink' profile field. User::setDonationLink() (objects/user.php) stores the value and save() validates it only with filtervar(..., FILTERVALIDATEURL), which accepts strings such as http://evil.example/"onmouseover=alert(document.domain)//, while getDonationLink() applies only striptags() and does not encode double quotes. plugin/CustomizeUser/actionButton.php echoes the value unencoded into an <a href="..."> attribute, and that button is included from view/modeYoutubeBottom.php on the watch page when the CustomizeUser option allowDonationLink is enabled. An authenticated user who updates their own profile via objects/userUpdate.json.php can therefore break out of the href attribute and inject an event handler that executes JavaScript in the browser of any visitor—including an administrator—who views the attacker's videos and interacts with (for example, hovers over) the donation button. The issue was unfixed at the time of reporting.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AVideoto a version that resolves this vulnerability.Patch c3edcc274c389816d434acadac07ee78eaf330c1 - Configuration
Disable the CustomizeUser option allowDonationLink so watch page donationLink buttons are not rendered with the unencoded user-provided href value.
AVideo CustomizeUser option allowDonationLink allowDonationLink = enabled
Event History
Frequently Asked Questions
Who is exposed to this issue?
Visitors to watch pages are exposed when they view videos from an attacker-controlled account and interact with that account's donation button, such as by hovering over it. Administrators are also affected if they visit such a watch page.
What does an attacker need to exploit it?
The attacker needs an authenticated AVideo account that can update its own profile. They can submit a crafted donationLink value through objects/userUpdate.json.php and then rely on visitors viewing their videos.
Is the vulnerable feature enabled by default?
The affected button is included on watch pages only when the CustomizeUser allowDonationLink option is enabled. The available information does not state whether that option is enabled by default.
What can be done if patching is not immediately possible?
Disable the CustomizeUser allowDonationLink option to prevent the donation button from being rendered on watch pages. Review and remove suspicious donationLink values from user profiles, particularly values containing quotes or event-handler-like text.
How can administrators determine whether they may already be affected?
Inspect stored user donationLink profile values and identify entries containing double quotes or HTML/JavaScript-style attribute content. Accounts with such values may be able to trigger script execution when their donation buttons are displayed and interacted with.