High severity · published Sep 17, 2026
CVE-2026-77615
Paella Player: Stored XSS via caption cue text
8.7
CVSS
0.6%
EPSS
No
On KEV
Description
Paella Player is a set of libraries to create a multi stream video player. Prior to Paella Player 2.12.11 (as used in Opencast prior to 19.7 and 20.2), there is a potential XSS attack though closed captions cue text. This vulnerability is fixed in 2.12.11.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
High
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
opencast · opencast
< 19.7; >= 20.0, < 20.2 · source: vendor
PA
paella-player · polimediaupv
< 2.12.11 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-77615
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-77615
github.com
https://github.com/opencast/opencast/commit/701682c635f668228c3e8fb7b4564b3294788e40
github.com
https://github.com/opencast/opencast/pull/7736
github.com
https://github.com/opencast/opencast/releases/tag/19.7
github.com
https://github.com/opencast/opencast/releases/tag/20.2
github.com
https://github.com/opencast/opencast/security/advisories/GHSA-m6c8-jcw2-5r25
github.com
https://github.com/polimediaupv/paella-core/commit/94a36490808ac5a1f60a0745d71ec9253f6d206b
More from opencast
8.8
CVE-2026-77614
Opencast: Session fixation in login enables account takeover via crafted link
8.8
CVE-2017-1000217
Opencast 2.3.2 and older versions are vulnerable to script injections through media and metadata in the player and media module resulting in arbitrary code execution, fixed in…
6.5
CVE-2025-54380
Opencast still publishes global system account credentials
5.4
CVE-2025-61788
Opencast Paella Player 7 vulnerable to Cross-Site-Scripting
5.3
CVE-2025-55202
Opencast has a partial path traversal vulnerability in UI config