CVE-2026-50183

Name of the Vulnerable Software and Affected Versions AVideo versions 29.0 and earlier

Description A stored Cross-Site Scripting (XSS) issue exists in the YouTubeAPI plugin. The plugin retrieves the snippet.title field from the YouTube Data API and renders it into the homepage gallery markup without proper HTML encoding. Since the video title is controlled by the uploader, an attacker can inject a JavaScript-bearing string into the title of a video that matches the operator's configured search query. This payload executes in the browser of any visitor loading a page that renders the gallery.

If the visitor is an administrator, the injected script can perform administrative actions—such as creating users, promoting accounts to admin, changing configurations, or installing plugins—that rely on cookie-based authentication without CSRF tokens, potentially leading to full administrative takeover. The malicious payload persists for the duration of the cacheTimeout (default 3600 seconds), even if the video is removed from YouTube.

Technical details include the following:

Recommendations Update AVideo to a version later than 29.0. As a temporary mitigation, disable the YouTubeAPI plugin or set the showGallerySection configuration to false.