high · 8.7CVE-2026-77615Sep 18, 2026

CVE-2026-77615: Opencast Paella Player Stored XSS via Caption Cue Text

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

A non-admin Opencast user can embed JavaScript in a WebVTT or DFXP subtitle file that runs in every viewer's browser the moment they turn captions on, including anonymous visitors.

Packageorg.opencastproject:opencast-engage-paella-player-7
Ecosystemmaven
Affected< 19.7
Fixed in19.7

The problem

The Paella player captions canvas writes each active cue directly to _captionsContainer.innerHTML without any HTML escaping. Any markup inside the cue becomes live DOM and executes in the Opencast origin.

Caption tracks are published through the default fast workflow and served verbatim to anonymous clients via /search/episode.json. The WebVTT and DFXP caption plugins are enabled in the default player configuration, so no non-default setup is needed. A content author with event-creation and subtitle-upload roles, but no admin rights, is enough to plant the payload.

Proof of concept

A working proof-of-concept for CVE-2026-77615 in org.opencastproject:opencast-engage-paella-player-7, with the exact payload below.

text
WEBVTT

00:00:00.000 --> 00:00:30.000
<img src=x onerror=document.title=window.__xss=document.domain>

The root cause is a classic innerHTML sink in paella-core's captions canvas. The loop that displays active cues does _captionsContainer.innerHTML += cue, so any HTML in the cue string is parsed and executed by the browser. No sanitization step exists between the caption file on disk and that assignment, and Opencast ships no Content-Security-Policy to contain the damage.

The paella-core patch commits (94a36490 and 9b2f14ec) replace the innerHTML concatenation with safe DOM construction, creating text nodes instead of parsing raw HTML. The companion Opencast commit (701682c6) sweeps the player-7 plugins for the same pattern, switching remaining innerHTML writes to innerText/textContent.

CWE-79 (Stored XSS).

The fix

Upgrade Opencast to 19.7 or 20.2, which bundle paella-core 2.12.11. The fix is in paella-core itself: update that dependency if you build the player from source. No workaround short of disabling caption plugins (enabled: false in etc/ui-config/mh_default_org/paella7/config.json for the WebVTT and DFXP plugins) is available for older releases.

Reported by Jan Kahmen (turingpoint).

References: [1][2][3][4][5][6]

Related research