CVE-2026-35180
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
WWBN AVideo open source video platform versions 26.0 and earlier have a CSRF vulnerability in the site customization endpoint. It lacks CSRF token validation and writes uploaded logo files before ORM security checks, allowing cross-origin POST to overwrite the logo.
Risk Assessment
A CSRF attack could replace the platform logo with attacker-controlled content, potentially leading to phishing or reputational damage.
Recommendation
Update AVideo to version 26.1 or later. Implement CSRF token validation and restrict file writes before domain verification.
Original NVD description (English source)
WWBN AVideo is an open source video platform. In versions 26.0 and prior, the site customization endpoint at admin/customize_settings_nativeUpdate.json.php lacks CSRF token validation and writes uploaded logo files to disk before the ORM's domain-based security check executes. Combined with SameSite=None cookie policy, a cross-origin POST can overwrite the platform's logo with attacker-controlled content.