TI-2025-38181 Aliases CVE-2025-61788 GHSA-m2vg-rmq6-p62r

Opencast Paella Player 7 vulnerable to Cross-Site-Scripting

LOW 23CWE-79Published 2025-10-08 · Updated 2025-10-08

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Cross-site scripting
Confidentiality · integrity · availability: None · None · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 17.8 and 18.2, the paella would include and render some user inputs (metadata like title, description, etc.) unfiltered and unmodified. The vulnerability allows attackers to inject and malicious HTML and JavaScript in the player, which would then be executed in the browsers of users watching the prepared media. This can then be used to modify the site or to execute actions in the name of logged-in users. To inject malicious metadata, an attacker needs write access to the system. For example, the ability to upload media and modify metadata. This cannot be exploited by unauthenticated users. This issue is fixed in Opencast 17.8 and 18.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00217 12th percentileScored 2026-11-07

Fix Fixed opencast (opencast): 17.8, 18.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
opencast	opencast	before 17.8; 18.0 to before 18.2	17.8, 18.2	Patch available	CNA
—	org.opencastproject:opencast-common (Maven)	up to 16.10	—	No fix listed	GHSA-m2vg-rmq6-p62r

opencast Vendoropencast Affected before 17.8; 18.0 to before 18.2 Fixed in 17.8, 18.2 Patch available CNA
org.opencastproject:opencast-common (Maven) Vendor— Affected up to 16.10 Fixed in — No fix listed GHSA-m2vg-rmq6-p62r

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:apereo:opencast::::::::	before 17.8; 18.0 to before 18.2	Vulnerable	Apereo

cpe:2.3:a:apereo:opencast:*:*:*:*:*:*:*:* Versions before 17.8; 18.0 to before 18.2 Vulnerable ·Apereo

Remediation

Fix · CNA opencast (opencast) Fixed in 17.8, 18.2

Timeline

2026-10-02 Threatist record created from CVE-2025-61788
2026-10-03 Alias added: GHSA-m2vg-rmq6-p62r

References

Patch 1

https://github.com/opencast/opencast/commit/2809520fa88d108d8104c760f00c10bad42c14f9

Advisory 2

Other 1

https://github.com/opencast/opencast

TI-2026-54099 Paella Player: Stored XSS via caption cue text CVSS 3.1HIGH 8.7
TI-2026-54098 Opencast: Session fixation in login enables account takeover via crafted link CVSS 3.1HIGH 8.8
TI-2021-19627 Files Accessible to External Parties in Opencast CVSS 3.1CRITICAL 9.9
TI-2025-38256 Opencast's editor accidentally publishes videos/overwrites publications #1626 CVSS 4.0LOW 2.3
TI-2020-04262 Authentication Bypass For Endpoints With Anonymous Access in OpenCast CVSS 3.1CRITICAL 10.0
TI-2017-14534 Opencast 2.3.2 and older versions are vulnerable to script injections through media and… CVSS 3.0HIGH 8.8

See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences