{"id":"CVE-2026-35449","aliases":["EUVD-2026-19531","GHSA-hg8q-8wqr-35xx"],"status":"published","title":"WWBN AVideo has Unauthenticated Information Disclosure via Disabled CLI Guard in install/test.php","description":"WWBN AVideo is an open source video platform. In versions 26.0 and prior, the install/test.php diagnostic script has its CLI-only access guard disabled by commenting out the die() statement. The script remains accessible via HTTP after installation, exposing video viewer statistics including IP addresses, session IDs, and user agents to unauthenticated visitors.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00345,"percentile":0.28316,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-200"],"published":"2026-04-04T06:16:18Z","modified":"2026-10-28T02:30:22Z","affected":[{"source":"ghsa","ecosystem":"Packagist","package":"wwbn/avideo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"26.0"}]}]},{"source":"osv","ecosystem":"Packagist","package":"wwbn/avideo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"26.0"}]}],"versions":["10.4","10.8","11","11.1","11.1.1","11.5","11.6","12.4","14.3","14.3.1","14.4","18.0","21.0","22.0","24.0","25.0","26.0"]}],"products":[{"vendor":"wwbn","product":"avideo"}],"references":[{"url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-hg8q-8wqr-35xx","tags":["x_refsource_CONFIRM","exploit","Exploit","Mitigation","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35449","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-hg8q-8wqr-35xx"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35449.json","tags":["advisory"]},{"url":"https://github.com/WWBN/AVideo","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-35449","title":"WWBN AVideo has Unauthenticated Information Disclosure via Disabled CLI Guard in install/test.php","description":"WWBN AVideo is an open source video platform. In versions 26.0 and prior, the install/test.php diagnostic script has its CLI-only access guard disabled by commenting out the die() statement. The script remains accessible via HTTP after installation, exposing video viewer statistics including IP addresses, session IDs, and user agents to unauthenticated visitors.","status":"published","published":"2026-04-06T21:46:07.363Z","modified":"2026-04-07T13:28:55.133Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:20:05.505362Z"}],"euvd":[{"id":"EUVD-2026-19531","description":"WWBN AVideo is an open source video platform. In versions 26.0 and prior, the install/test.php diagnostic script has its CLI-only access guard disabled by commenting out the die() statement. The script remains accessible via HTTP after installation, exposing video viewer statistics including IP addresses, session IDs, and user agents to unauthenticated visitors.","status":"published","published":"2026-04-06T21:46:07Z","modified":"2026-04-07T13:28:55Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T19:25:14.820353Z"}],"ghsa":[{"id":"GHSA-hg8q-8wqr-35xx","title":"AVideo: Unauthenticated Information Disclosure via Disabled CLI Guard in install/test.php","description":"## Summary\n\nThe `install/test.php` diagnostic script has its CLI-only access guard disabled by commenting out the `die()` statement. The script remains accessible via HTTP after installation, exposing video viewer statistics including IP addresses, session IDs, and user agents to unauthenticated visitors.\n\n## Details\n\nThe disabled guard at `install/test.php:5-7`:\n\n```php\nif (!isCommandLineInterface()) {\n    //return die('Command Line only');\n}\n```\n\nThe script also enables verbose error reporting:\n\n```php\nerror_reporting(E_ALL);\nini_set('display_errors', '1');\n```\n\nIt then queries `VideoStatistic::getLastStatistics()` and outputs the result via `var_dump()`:\n\n```php\n$resp = VideoStatistic::getLastStatistics(getVideos_id(), User::getId());\nvar_dump($resp);\n```\n\nThe `VideoStatistic` object contains: `ip` (viewer IP address), `session_id`, `user_agent`, `users_id`, and JSON metadata. The `display_errors=1` setting also leaks internal filesystem paths in any PHP warnings.\n\nThe `install/` directory is not restricted by `.htaccess` (it only disables directory listing via `Options -Indexes`) and no web server rules block access to individual PHP files in this directory.\n\n## Proof of Concept\n\n```bash\n# Request viewer stats for video ID 1\ncurl \"https://your-avideo-instance.com/install/test.php?videos_id=1\"\n```\n\nConfirmed accessible on live AVideo instances (HTTP 200).\n\n## Impact\n\nUnauthenticated disclosure of viewer IP addresses (PII under GDPR), session identifiers, and user agents. The enabled `display_errors` also reveals internal server paths on errors.\n\n- **CWE**: CWE-200 (Exposure of Sensitive Information)\n- **Severity**: Low\n\n## Recommended Fix\n\nUncomment the CLI guard at `install/test.php:6` to restore the intended access restriction:\n\n```php\nif (!isCommandLineInterface()) {\n    return die('Command Line only');\n}\n```\n\n---\n*Found by [aisafe.io](https://aisafe.io)*","status":"published","published":"2026-04-04T06:16:18Z","modified":"2026-04-07T14:20:47Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:39:50.076383Z"}],"nvd":[{"id":"CVE-2026-35449","description":"WWBN AVideo is an open source video platform. In versions 26.0 and prior, the install/test.php diagnostic script has its CLI-only access guard disabled by commenting out the die() statement. The script remains accessible via HTTP after installation, exposing video viewer statistics including IP addresses, session IDs, and user agents to unauthenticated visitors.","status":"published","published":"2026-04-06T22:16:23.31Z","modified":"2026-07-24T21:10:00.143Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:12:13.1424Z"}],"osv":[{"id":"CVE-2026-35449","title":"WWBN AVideo has Unauthenticated Information Disclosure via Disabled CLI Guard in install/test.php","description":"WWBN AVideo is an open source video platform. In versions 26.0 and prior, the install/test.php diagnostic script has its CLI-only access guard disabled by commenting out the die() statement. The script remains accessible via HTTP after installation, exposing video viewer statistics including IP addresses, session IDs, and user agents to unauthenticated visitors.","status":"published","published":"2026-04-06T21:46:07.363Z","modified":"2026-10-28T02:30:22.804922639Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:45:02.673625Z"},{"id":"GHSA-hg8q-8wqr-35xx","title":"AVideo: Unauthenticated Information Disclosure via Disabled CLI Guard in install/test.php","description":"## Summary\n\nThe `install/test.php` diagnostic script has its CLI-only access guard disabled by commenting out the `die()` statement. The script remains accessible via HTTP after installation, exposing video viewer statistics including IP addresses, session IDs, and user agents to unauthenticated visitors.\n\n## Details\n\nThe disabled guard at `install/test.php:5-7`:\n\n```php\nif (!isCommandLineInterface()) {\n    //return die('Command Line only');\n}\n```\n\nThe script also enables verbose error reporting:\n\n```php\nerror_reporting(E_ALL);\nini_set('display_errors', '1');\n```\n\nIt then queries `VideoStatistic::getLastStatistics()` and outputs the result via `var_dump()`:\n\n```php\n$resp = VideoStatistic::getLastStatistics(getVideos_id(), User::getId());\nvar_dump($resp);\n```\n\nThe `VideoStatistic` object contains: `ip` (viewer IP address), `session_id`, `user_agent`, `users_id`, and JSON metadata. The `display_errors=1` setting also leaks internal filesystem paths in any PHP warnings.\n\nThe `install/` directory is not restricted by `.htaccess` (it only disables directory listing via `Options -Indexes`) and no web server rules block access to individual PHP files in this directory.\n\n## Proof of Concept\n\n```bash\n# Request viewer stats for video ID 1\ncurl \"https://your-avideo-instance.com/install/test.php?videos_id=1\"\n```\n\nConfirmed accessible on live AVideo instances (HTTP 200).\n\n## Impact\n\nUnauthenticated disclosure of viewer IP addresses (PII under GDPR), session identifiers, and user agents. The enabled `display_errors` also reveals internal server paths on errors.\n\n- **CWE**: CWE-200 (Exposure of Sensitive Information)\n- **Severity**: Low\n\n## Recommended Fix\n\nUncomment the CLI guard at `install/test.php:6` to restore the intended access restriction:\n\n```php\nif (!isCommandLineInterface()) {\n    return die('Command Line only');\n}\n```\n\n---\n*Found by [aisafe.io](https://aisafe.io)*","status":"published","published":"2026-04-04T06:16:18Z","modified":"2026-04-07T14:35:36.60892Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:49.28217Z"}]}}