CVE-2026-97233: volotat Anagnorisis Media Filename PlaylistManager.js html cross site scripting
A vulnerability was identified in volotat Anagnorisis up to 0.4.11. Affected by this issue is the function html of the file PlaylistManager.js of the component Media Filename Handler. Such manipulation of the argument filepath leads to cross site scripting. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which versions should be considered affected?
volotat Anagnorisis versions up to and including 0.4.11 are identified as affected.
What does an attacker need to exploit this issue?
The attack can be launched remotely, but the severity vector indicates the attacker needs low-level privileges and requires user interaction. Exploitation involves manipulating the file_path argument handled by the media filename component.
Is exploit code available?
Yes. The vulnerability information states that a public exploit is available and might be used.
Is a vendor fix or response documented?
No vendor response is documented. The vendor was contacted early about the disclosure but reportedly did not respond.