Vulnerability · Published Apr 6, 2026 · Assigned by GitHub_M
CVE-2026-35449WWBN AVideo has Unauthenticated Information Disclosure via Disabled CLI Guard in install/test.php
Medium 5.3
In plain English
A medium-severity information exposure in AVideo from WWBN. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.3%top 71.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
WWBN AVideo is an open source video platform. In versions 26.0 and prior, the install/test.php diagnostic script has its CLI-only access guard disabled by commenting out the die() statement. The script remains accessible via HTTP after installation, exposing video viewer statistics including IP addresses, session IDs, and user agents to unauthenticated visitors.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | wwbn/avideo | no fix listed | GHSA-hg8q-8wqr-35xx |
Affected products (as reported)
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- https://github.com/WWBN/AVideo/security/advisories/GHSA-hg8q-8wqr-35xx x_refsource_CONFIRM