CVE-2026-35452: AVideo Unauthenticated Information Disclosure Vulnerability
MODERATECVE-2026-35452 is a MODERATE (CVSS 5.3) unauthenticated information disclosure vulnerability (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) affecting AVideo libraries in the Packagist ecosystem. The issue involves unauthenticated information disclosure via missing auth on clonesite client.log.php. Remediation is available in the latest vendor maintenance releases.
CVE-2026-35452 at a Glance
Security Impact
CVSS: 5.3
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
How to Fix CVE-2026-35452
To remediate this vulnerability, upgrade all affected AVideo dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade wwbn/avideo to Latest secure releaseRun the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for wwbn/avideoHow to Check if You Are Affected
To determine whether your application is affected by CVE-2026-35452, inspect your project dependencies for AVideo:
inspect dependencies for wwbn/avideoAnalyze the terminal output to locate any version of AVideo in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, where the product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. In AVideo, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2026-35452 Affected AVideo Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
wwbn/avideo
|
Packagist |
≤ 26.0
|
|
References
Frequently Asked Questions
What is CVE-2026-35452?
Which AVideo versions are affected?
What version fixes CVE-2026-35452?
Is wwbn/avideo affected?
What is the CVSS score of CVE-2026-35452?
What CWE is associated with CVE-2026-35452?
How can I check Packagist dependencies for CVE-2026-35452?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-99j6-hj87-6fcf",
"modified" : "2026-04-07T14:20:54Z",
"published" : "2026-04-04T06:17:17Z",
"aliases" : [ "CVE-2026-35452" ],
"summary" : "AVideo: Unauthenticated Information Disclosure via Missing Auth on CloneSite client.log.php",
"details" : "## Summary\n\nThe `plugin/CloneSite/client.log.php` endpoint serves the clone operation log file without any authentication. Every other endpoint in the CloneSite plugin directory enforces `User::isAdmin()`. The log contains internal filesystem paths, remote server URLs, and SSH connection metadata.\n\n## Details\n\nThe entire file at `plugin/CloneSite/client.log.php`:\n\n```php\n<?php\ninclude '../../videos/cache/clones/client.log';\n```\n\nNo authentication check. The log file is populated by `cloneClient.json.php` which writes operational details during clone operations:\n\n```php\n// plugin/CloneSite/cloneClient.json.php:118\n$log->add(\"Clone (2 of {$totalSteps}): Geting MySQL Dump file [$cmd]\");\n```\n\nThe `$cmd` variable contains wget commands with internal filesystem paths, and rsync command templates with SSH connection details (username, IP, port).\n\nCompare with sibling endpoints:\n- `plugin/CloneSite/index.php` checks `User::isAdmin()`\n- `plugin/CloneSite/changeStatus.json.php` checks `User::isAdmin()`\n- `plugin/CloneSite/clones.json.php` checks `User::isAdmin()`\n- `plugin/CloneSite/delete.json.php` checks `User::isAdmin()`\n\n## Proof of Concept\n\n```bash\ncurl \"https://your-avideo-instance.com/plugin/CloneSite/client.log.php\"\n```\n\nIf the CloneSite feature has been used, the response contains wget commands, filesystem paths, SSH metadata, and SQL dump file locations.\n\n## Impact\n\nUnauthenticated disclosure of internal infrastructure details that could aid targeted attacks against the clone source server.\n\n## Recommended Fix\n\nAdd an admin authentication check at `plugin/CloneSite/client.log.php`, before the include:\n\n```php\nrequire_once '../../videos/configuration.php';\nif (!User::isAdmin()) {\n http_response_code(403);\n die('Access denied');\n}\n```\n\n---\n*Found by [aisafe.io](https://aisafe.io)*",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Packagist",
"name" : "wwbn/avideo"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"last_affected" : "26.0"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/WWBN/AVideo/security/advisories/GHSA-99j6-hj87-6fcf"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-35452"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/WWBN/AVideo"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-200" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2026-04-04T06:17:17Z",
"nvd_published_at" : "2026-04-06T22:16:23Z"
}
}