Packagist/wwbn/avideo CVE-2026-27568: medium 6.1, EPSS 0.26%

AVideo has Stored Cross-Site Scripting via Markdown Comment Injection

Action: Upgrade wwbn/avideo to 21.0 or later.

composer require wwbn/avideo:21.0

Affected

Fixed versions

Sources

• osv: GHSA-rcqw-6466-3mv7
• nvd: CVE-2026-27568
• https://github.com/WWBN/AVideo/security/advisories/GHSA-rcqw-6466-3mv7
• https://github.com/WWBN/AVideo/commit/ade348ed6d28b3797162c3d9e98054fb09ec51d7
• https://github.com/WWBN/AVideo
• https://github.com/WWBN/AVideo/releases/tag/21.0

CVE-2026-27568 · published 2026-02-20T21:15:06Z · modified 2026-02-24T16:34:57.675522Z · JSON