CVE-2026-41061: WWBN AVideo has Stored XSS via Unanchored Duration Regex in Video Encoder Receiver

April 14, 2026 (updated April 24, 2026)

The isValidDuration() regex at objects/video.php:918 uses /^[0-9]{1,2}:[0-9]{1,2}:[0-9]{1,2}/ without a $ end anchor, allowing arbitrary HTML/JavaScript to be appended after a valid duration prefix. The crafted duration is stored in the database and rendered without HTML escaping via echo Video::getCleanDuration() on trending pages, playlist pages, and video gallery thumbnails, resulting in stored cross-site scripting.

References

github.com/WWBN/AVideo/commit/bcba324644df8b4ed1f891462455f1cd26822a45
github.com/WWBN/AVideo/security/advisories/GHSA-8pv3-29pp-pf8f
github.com/advisories/GHSA-8pv3-29pp-pf8f
nvd.nist.gov/vuln/detail/CVE-2026-41061

Code Behaviors & Features

Detect and mitigate CVE-2026-41061 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →