CVE-2026-89246 WWBN CVE debrief

Who should care

Defenders responsible for AVideo instances, administrators, and video owners should assess exposure and prioritize mitigation. This includes reviewing the AVideo instance's configuration, verifying the existence of the vulnerability, and implementing recommended actions to prevent potential data breaches or arbitrary code execution.

Why it matters

AVideo myComments.download.php CSV formula injection vulnerability allows authenticated users to inject spreadsheet formulas that execute when administrators or video owners open the exported CSV file, potentially leading to data breaches or arbitrary code execution.

• Authenticated users can inject malicious formulas that execute when administrators or video owners open the exported CSV file.
• Successful exploitation could lead to arbitrary code execution or data theft.
• Defenders should verify and mitigate this vulnerability to prevent potential data breaches.
• Remediation priority is high due to the potential for data breaches.

Technical summary

The myComments.download.php endpoint in AVideo fails to sanitize spreadsheet formula prefixes in comment text, allowing authenticated users to inject formulas that execute when administrators or video owners open the exported CSV file in spreadsheet applications. The vulnerability can be verified by checking the AVideo instance's myComments.download.php endpoint for proper input validation and sanitization of comment text. Defenders should prioritize verifying and mitigating this vulnerability, especially in systems where administrators or video owners have access to exported CSV files.

Defensive priority

Defenders should prioritize verifying and mitigating this vulnerability, especially in systems where administrators or video owners have access to exported CSV files.

Recommended defensive actions

• Verify the vulnerability exists in the AVideo instance and assess exposure
• Restrict access to the myComments.download.php endpoint to trusted users
• Implement input validation and sanitization for comment text
• Monitor for suspicious activity related to CSV file exports
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability exists in the myComments.download.php endpoint of AVideo, allowing authenticated users to inject formulas starting with =, +, -, or @ characters. The injected formulas execute when administrators or video owners open the exported CSV file in spreadsheet applications. This vulnerability can be verified by checking the AVideo instance's myComments.download.php endpoint for proper input validation and sanitization of comment text. Defenders should verify and mitigate this vulnerability to prevent potential data breaches

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.