CVE-2025-61788: Opencast's Paella Player 7 is vulnerable to Cross-Site Scripting

The vulnerability is a classic stored Cross-Site Scripting (XSS) issue within the Paella Player plugins of Opencast. The root cause is the unsafe rendering of user-provided metadata. The investigation of the patch commit 2809520fa88d108d8104c760f00c10bad42c14f9 confirms this. In multiple plugins, the getContent method was responsible for generating HTML to be displayed in the player UI. These methods used JavaScript template literals to directly embed metadata values (like title, description, series name, etc.) into HTML strings. An attacker with permissions to edit event metadata could save malicious HTML/JavaScript content in these fields.

The patch systematically resolves this issue by refactoring the code to first create static HTML templates and then populate the dynamic data using safe properties like .innerText or .textContent. This ensures that any user-provided data is treated as plain text and not interpreted as HTML by the browser, thus neutralizing the XSS vector. The identified vulnerable functions are all named getContent within their respective plugin classes, as this is where the unsafe HTML generation occurred. Any of these functions would appear in a runtime profile or stack trace during the exploitation of this vulnerability when the corresponding UI element (e.g., description pop-up, downloads list) is rendered.