CVEvulnerability

CVE-2026-55491

5.4 MEDIUM Published 2026-08-20 Modified 2026-10-26 Official page ↗

Status: Deferred
Published: 2026-08-20
Last modified: 2026-10-26
Assigner: [email protected]
CVSS 3.1 ([email protected]): 5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses: CWE-79

Description

BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton failed to escape meetingName in record-and-playback/screenshare/playback/index.html.erb when generating the screenshare playback format. A low-privileged user could store a crafted meeting name that embedded script content, and the script executed in another user's browser when that user replayed the recording. This issue is fixed in version 3.0.29.

Weakness · CWE (1)

CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References

https://github.com/bigbluebutton/bigbluebutton/commit/a53f2b92022388bfa4109d3136d1f3a932404b1b github.com
https://github.com/bigbluebutton/bigbluebutton/releases/tag/v3.0.29 github.com
https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-57p5-c888-74f9 github.com

CVE-2026-55491

Description

Related

Weakness · CWE (1)

References