CVE-2025-61788: Cross-Site Scripting Vulnerability in Opencast's Paella Player
Summary
CVE-2025-61788: Opencast's Paella Player 7 is vulnerable to Cross-Site Scripting. Affects org.opencastproject:opencast-common versions < 16.10. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Opencast is an open-source platform designed for managing and distributing educational video content. It includes various components, one of which is the Paella Player, used for rendering video content. The platform allows users to upload media and manage metadata, making it a powerful tool for educational institutions. However, prior versions of Opencast, specifically versions before 17.8 and 18.2, have a critical vulnerability that allows for the injection of malicious scripts through unfiltered user inputs.
Vulnerability Detail
The vulnerability arises from the Paella Player's failure to properly sanitize user inputs, such as metadata fields (title, description, etc.). This oversight allows attackers with write access to inject malicious HTML and JavaScript into the player. When executed, these scripts can manipulate the site or perform actions on behalf of logged-in users, posing significant security risks. This vulnerability is classified under CWE-79, indicating its nature as a Cross-Site Scripting (XSS) issue.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to upgrade to the patched versions as soon as they are available.
Conclusion
The CVE-2025-61788 vulnerability in Opencast's Paella Player poses a significant risk due to its potential for Cross-Site Scripting attacks. Users are advised to upgrade to the patched versions as soon as they become available and to monitor their systems for any signs of exploitation.
See every vulnerability recorded for org.opencastproject:opencast-common →
FAQ
CVE-2025-61788 is a vulnerability in Opencast's Paella Player that allows for Cross-Site Scripting (XSS) attacks due to unfiltered user inputs.
Only users with write access to the system, such as those who can upload media and modify metadata, can exploit this vulnerability.
Attackers can inject malicious scripts that may alter the site or execute actions in the context of logged-in users, leading to data theft or unauthorized actions.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
Yes, the vulnerability is fixed in Opencast versions 17.8 and 18.2, but these versions are not yet published to the Maven registry.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.opencastproject:opencast-common.
