Opencast: Stored XSS in the Paella player via caption cues (WebVTT/DFXP)

A content author without administrator rights uploads a caption file with HTML in the cue text; the Paella player writes the cue into the DOM via innerHTML without escaping, so watching with captions enabled runs JavaScript in every viewer's session.

Advisory ID: TP-2026-049
Product: Opencast (open-source system for capturing, managing, and delivering lecture and video content)
Vulnerability type: Stored cross-site scripting (CWE-79)
CVE: CVE-2026-77615
CVSS 3.1: 8.7 (High) · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Vendor advisory: GHSA-m6c8-jcw2-5r25
Affected versions: opencast-engage-paella-player-7 and -8 < 19.7 and < 20.2 (verified on 18.8 and 20.0, Docker allinone)
Fixed in: 19.7, 20.2
Reported: 17 June 2026

Summary

Opencast is an open-source system for capturing, managing, and delivering lecture and video content; the bundled Paella player renders captions in the viewer's browser. The player writes the text of each active caption cue into the DOM via innerHTML without escaping, so HTML in a WebVTT or DFXP cue becomes live DOM in the Opencast origin. A content author without administrator rights uploads a caption file carrying an HTML payload in the cue text and publishes the event; /search/episode.json then serves the caption track to anyone, including anonymous viewers. As soon as a viewer enables captions, the script runs in their session, which allows theft of session and CSRF tokens and takeover of an administrator session. turingpoint verified the chain live on 18.8 and current 20.0 (execution in the browser, <img onerror> in the captions container) and reported it to the vendor, which fixed it in 19.7 and 20.2.

Root cause

The Paella player's captions canvas appends each active cue with _captionsContainer.innerHTML += cue (bundled paella-core, served at /paellaN/ui/paella-player.js), so HTML in the cue text becomes live DOM in the engage origin. The caption entry is built from any media package element with a captions/* flavor (modules/engage-paella-player-7/src/js/EpisodeConversor.js:392), and /search/episode.json serves the manifest and caption file to anonymous clients too. The WebVTT and DFXP plugins are enabled by default (etc/ui-config/mh_default_org/paella7/config.json:571/:574), and the "Subtitles" upload (captions/source, .vtt) is a default option (etc/listproviders/event.upload.asset.options.properties). The partial-process-uploaded-captions workflow only cuts and tags the file and never sanitizes it, and there is neither a CSP nor X-Content-Type-Options. A content author without administrator rights (ROLE_API_EVENTS_CREATE/ROLE_UI_TASKS_CREATE) therefore plants the cue, which fires for every viewer who enables captions, including anonymous viewers and logged-in administrators.

Proof of Concept

# 1. Upload a caption file (WebVTT) with HTML in the cue text, as a content author:
WEBVTT

00:00:00.000 --> 00:00:10.000
<img src=x onerror="alert(document.domain)">

# 2. Publish the event; /search/episode.json serves the caption track to every viewer.
# 3. A viewer opens the player and enables captions:
#    the cue is appended via innerHTML += into _captionsContainer -> the script fires.

The cue text is appended to _captionsContainer.innerHTML without escaping, so <img src=x onerror=…> is parsed as a real DOM element and the handler runs in the Opencast origin. Because the caption track is served anonymously through /search/episode.json, execution reaches every viewer of the published video who turns captions on.

Impact

  • JavaScript execution in the Opencast origin in the session of every viewer who enables captions, including anonymous and logged-in users.
  • Theft of session and CSRF tokens and actions through the Opencast API on behalf of the victim.
  • Takeover of an administrator session when an administrator watches the video with captions enabled (content author without special rights → administrator).
  • Stored by a content author without administrator rights; triggered for every viewer with captions enabled.

References

Is Something Like This in Your Software?

Our team found this vulnerability in the course of its work. Have your applications reviewed by the same specialists, with a penetration test from turingpoint.

Request a Pentest