CVE-2026-43882 WWBN AVideo: Unauthenticated CRLF/ICS Injection in Scheduler downloadICS.php Allows Calendar Event Spoofing
Unauthenticated CRLF injection in AVideo allows attackers to spoof calendar events via malicious ICS files, enabling high-credibility phishing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-43882?
CVE-2026-43882 is a medium-severity vulnerability in WWBN AVideo, published on 11 May 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
WWBN AVideo is an open source video platform. In versions up to and including 29.0, the unauthenticated plugin/Scheduler/downloadICS.php endpoint passes attacker-controlled title, description, and joinURL parameters into Scheduler::downloadICS(), which builds an ICS calendar file via the ICS helper class. ICS::escape_string() (objects/ICS.php:167-169) only escapes , and ; and does NOT neutralize CR/LF, so attacker CRLF bytes inside a property value break out and inject arbitrary ICS lines — including END:VEVENT / BEGIN:VEVENT pairs that add entire attacker-controlled calendar events. Because the malicious .ics file is served from the victim's trusted AVideo origin, this enables high-credibility calendar phishing: forged meetings with attacker-chosen SUMMARY, URL, LOCATION, and DESCRIPTION landing in the victim's calendar after import. Commit 764db592f99e545aa86bb9a4ad664ffd14c38ba5 contains an updated fix.
Weakness: CWE-93
Which versions are affected by CVE-2026-43882?
2 open source packages ship an affected version, including wwbn/avideo.
| Package | Affected | Fixed in |
|---|---|---|
wwbn/avideo Packagist | All versions to 29.0 | None |
wwbn/avideo Packagist | All versions to 29.0 | None |
How do I fix CVE-2026-43882?
No fix has been published for CVE-2026-43882 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-43882 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-43882 exists.
Sources
Also known as GHSA-mwgh-92m2-wvhv.