CVE-2026-35449 — Sensitive Information Exposure in Avideo

CWE-200 — Sensitive Information Exposure4 documents4 sources
Severity
5.3MEDIUMNVD
EPSS
0.0%
top 89.45%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Wwbn Avideo
Timeline
Latest updateApr 4
PublishedApr 6

Description

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the install/test.php diagnostic script has its CLI-only access guard disabled by commenting out the die() statement. The script remains accessible via HTTP after installation, exposing video viewer statistics including IP addresses, session IDs, and user agents to unauthenticated visitors.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages2 packages

▶CVEListV5wwbn/avideo26.0
▶Packagistwwbn/avideo26.0

🔴Vulnerability Details

2
GHSA
AVideo: Unauthenticated Information Disclosure via Disabled CLI Guard in install/test.php↗2026-04-04
▶
OSV
AVideo: Unauthenticated Information Disclosure via Disabled CLI Guard in install/test.php↗2026-04-04
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-35449 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶