Every CVE Search/ Get API key

CVE-2026-35452

WWBN AVideo has Unauthenticated Information Disclosure via Missing Auth on CloneSite client.log.php

5.3 Medium

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the plugin/CloneSite/client.log.php endpoint serves the clone operation log file without any authentication. Every other endpoint in the CloneSite plugin directory enforces User::isAdmin(). The log contains internal filesystem paths, remote server URLs, and SSH connection metadata.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Exploit likelihood

0.38%Up 0.3 points since Apr 7, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.3

WWBN AVideo has Unauthenticated Information Disclosure via Missing Auth on CloneSite client.log.php

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the plugin/CloneSite/client.log.php endpoint serves the clone operation log file without any authentication. Every other endpoint in the CloneSite plugin directory enforces User::isAdmin(). The log contains internal filesystem paths, remote server URLs, and SSH connection metadata.

Record
CVE-2026-35452
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
EUVDEUVD-2026-19535 5.3

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the plugin/CloneSite/client.log.php endpoint serves the clone operation log file without any authentication. Every other endpoint in the CloneSite plugin directory enforces User::isAdmin(). The log contains internal filesystem paths, remote server URLs, and SSH connection metadata.

Record
EUVD-2026-19535
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-99j6-hj87-6fcf 5.3

AVideo: Unauthenticated Information Disclosure via Missing Auth on CloneSite client.log.php

Summary

The plugin/CloneSite/client.log.php endpoint serves the clone operation log file without any authentication. Every other endpoint in the CloneSite plugin directory enforces User::isAdmin(). The log contains internal filesystem paths, remote server URLs, and SSH connection metadata.

Details

The entire file at plugin/CloneSite/client.log.php:

<?php
include '../../videos/cache/clones/client.log';

No authentication check. The log file is populated by cloneClient.json.php which writes operational details during clone operations:

// plugin/CloneSite/cloneClient.json.php:118
$log->add("Clone (2 of {$totalSteps}): Geting MySQL Dump file [$cmd]");

The $cmd variable contains wget commands with internal filesystem paths, and rsync command templates with SSH connection details (username, IP, port).

Compare with sibling endpoints:

  • plugin/CloneSite/index.php checks User::isAdmin()
  • plugin/CloneSite/changeStatus.json.php checks User::isAdmin()
  • plugin/CloneSite/clones.json.php checks User::isAdmin()
  • plugin/CloneSite/delete.json.php checks User::isAdmin()

Proof of Concept

curl "https://your-avideo-instance.com/plugin/CloneSite/client.log.php"

If the CloneSite feature has been used, the response contains wget commands, filesystem paths, SSH metadata, and SQL dump file locations.

Impact

Unauthenticated disclosure of internal infrastructure details that could aid targeted attacks against the clone source server.

Recommended Fix

Add an admin authentication check at plugin/CloneSite/client.log.php, before the include:

require_once '../../videos/configuration.php';
if (!User::isAdmin()) {
    http_response_code(403);
    die('Access denied');
}

Found by aisafe.io

Record
GHSA-99j6-hj87-6fcf
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
NVD 5.3

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the plugin/CloneSite/client.log.php endpoint serves the clone operation log file without any authentication. Every other endpoint in the CloneSite plugin directory enforces User::isAdmin(). The log contains internal filesystem paths, remote server URLs, and SSH connection metadata.

Record
CVE-2026-35452
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
OSV 5.3

WWBN AVideo has Unauthenticated Information Disclosure via Missing Auth on CloneSite client.log.php

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the plugin/CloneSite/client.log.php endpoint serves the clone operation log file without any authentication. Every other endpoint in the CloneSite plugin directory enforces User::isAdmin(). The log contains internal filesystem paths, remote server URLs, and SSH connection metadata.

Record
CVE-2026-35452
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
OSVGHSA-99j6-hj87-6fcf 5.3

AVideo: Unauthenticated Information Disclosure via Missing Auth on CloneSite client.log.php

Summary

The plugin/CloneSite/client.log.php endpoint serves the clone operation log file without any authentication. Every other endpoint in the CloneSite plugin directory enforces User::isAdmin(). The log contains internal filesystem paths, remote server URLs, and SSH connection metadata.

Details

The entire file at plugin/CloneSite/client.log.php:

<?php
include '../../videos/cache/clones/client.log';

No authentication check. The log file is populated by cloneClient.json.php which writes operational details during clone operations:

// plugin/CloneSite/cloneClient.json.php:118
$log->add("Clone (2 of {$totalSteps}): Geting MySQL Dump file [$cmd]");

The $cmd variable contains wget commands with internal filesystem paths, and rsync command templates with SSH connection details (username, IP, port).

Compare with sibling endpoints:

  • plugin/CloneSite/index.php checks User::isAdmin()
  • plugin/CloneSite/changeStatus.json.php checks User::isAdmin()
  • plugin/CloneSite/clones.json.php checks User::isAdmin()
  • plugin/CloneSite/delete.json.php checks User::isAdmin()

Proof of Concept

curl "https://your-avideo-instance.com/plugin/CloneSite/client.log.php"

If the CloneSite feature has been used, the response contains wget commands, filesystem paths, SSH metadata, and SQL dump file locations.

Impact

Unauthenticated disclosure of internal infrastructure details that could aid targeted attacks against the clone source server.

Recommended Fix

Add an admin authentication check at plugin/CloneSite/client.log.php, before the include:

require_once '../../videos/configuration.php';
if (!User::isAdmin()) {
    http_response_code(403);
    die('Access denied');
}

Found by aisafe.io

Record
GHSA-99j6-hj87-6fcf
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
wwbn/avideo
Packagist
 through 26.0 None known
wwbn/avideo
Packagist
 through 26.0, plus listed versions
10.410.81111.111.1.1
Show 11 moreShow less
11.511.612.414.314.3.114.418.021.022.024.025.0
 None known

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-35452 is a medium vulnerability (CVSS 5.3) in Wwbn Avideo, published April 4, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.38%, the 32nd percentile. No source names a fixed version.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open