CVE-2026-49279: 
PHP 脆弱性の分析と軽減

CVE-2026-49279 is a stored Cross-Site Scripting (XSS) vulnerability in WWBN AVideo's WebSocket messaging system, specifically a bypass of a prior incomplete fix (CVE-2026-43874). The vulnerability exists in plugin/YPTSocket/MessageSQLite.php, where the autoEvalCodeOnHTML sanitization only covers the $json['msg'] key but not the $json['json'] key read by msgToResourceId(). It affects AVideo versions up to and including 29.0 (composer package wwbn/avideo). The advisory was published on May 25, 2026, and reviewed on June 4, 2026, with a CVSS v4 base score of 7.7 (High) (Github Advisory, AVideo Advisory).

The root cause is an incomplete sanitization implementation classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). In MessageSQLite.php, lines 268–271 only call unset($json['msg']['autoEvalCodeOnHTML']), stripping the dangerous key from the msg path only. However, msgToResourceId() at lines 361–367 reads from $msg['json'] with higher priority than $msg['msg'], and this path is never sanitized. An authenticated attacker exploits this by placing an autoEvalCodeOnHTML payload inside the json key of a WebSocket message rather than the msg key, bypassing the shallow strip entirely. Notably, sibling files Message.php and MessageSQLiteV2.php correctly apply removeAutoEvalCodeOnHTMLRecursive($json) across all nested paths, but MessageSQLite.php does not call this function at all (Github Advisory, AVideo Commit).

A successful exploit allows an authenticated attacker to execute arbitrary JavaScript in any connected victim's browser session via the WebSocket messaging system. This enables theft of session cookies and authentication tokens, account takeover through session hijacking, and the ability to chain with CSRF to perform admin-level actions on behalf of the victim. The vulnerability affects the default SQLite WebSocket backend configuration, meaning it is present in standard AVideo deployments without special configuration (AVideo Advisory).

1. Authenticate: Obtain a valid user account and authentication token on the target AVideo instance (low-privilege access is sufficient).
2. Identify target: Determine the WebSocket endpoint URL (wss://TARGET/plugin/YPTSocket/server.php) and obtain the victim's user ID (VICTIM_USER_ID) and a valid RESOURCE_ID.
3. Craft malicious WebSocket message: Construct a JSON payload placing the XSS code in the json key (not msg) to bypass sanitization:

const ws = new WebSocket('wss://TARGET/plugin/YPTSocket/server.php?token=USER_TOKEN');
ws.onopen = () => {
  ws.send(JSON.stringify({
    msg: "Hello",                              // decoy — sanitized path
    json: {autoEvalCodeOnHTML: "alert('XSS')"},// payload — unsanitized path
    to_users_id: VICTIM_USER_ID,
    resourceId: RESOURCE_ID
  }));
};

4. Bypass sanitization: The server's MessageSQLite.php strips autoEvalCodeOnHTML only from $json['msg']; the json key passes through unmodified.
5. Payload delivery: msgToResourceId() reads $msg['json'] first (higher priority), relaying the unsanitized payload to the victim's WebSocket client.
6. JavaScript execution: The victim's browser evaluates the autoEvalCodeOnHTML value, executing the attacker's JavaScript — enabling cookie theft, session hijacking, or further exploitation (AVideo Advisory).

• Network: Unusual WebSocket messages to wss://TARGET/plugin/YPTSocket/server.php containing both a msg key and a json key with an autoEvalCodeOnHTML field; WebSocket traffic with JavaScript payloads (e.g., alert, document.cookie, fetch) embedded in the json object.
• Logs: AVideo WebSocket server logs showing messages with a json key containing autoEvalCodeOnHTML from non-CLI, non-PHP sources; repeated WebSocket connections from a single authenticated user targeting multiple victim user IDs.
• File System: No direct file system artifacts expected for this XSS vector, but secondary payloads (e.g., credential harvesters) may be delivered to victim browsers and exfiltrate data to external hosts.
• Process/Application: Unexpected outbound HTTP requests from victim browsers to attacker-controlled domains following WebSocket message receipt, potentially visible in browser developer tools or proxy logs (AVideo Advisory).

The fix is implemented in commit 3e0b3ce by replacing the shallow unset($json['msg']['autoEvalCodeOnHTML']) with a call to $this->removeAutoEvalCodeOnHTMLRecursive($json) in MessageSQLite.php, consistent with the approach already used in Message.php and MessageSQLiteV2.php. Administrators should update to a version of AVideo that includes this commit. No configuration-based workaround is available; upgrading is the only reliable remediation. As an interim measure, restricting access to the WebSocket endpoint to trusted users or disabling the YPTSocket plugin can reduce exposure (AVideo Commit, Github Advisory).