PT-2026-30334 · Avideo · Avideo

Adrgs · Published 2026-04-04 · Updated 2026-04-06 · CVE-2026-35449

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions AVideo versions 26.0 and prior

Description The install/test.php diagnostic script has its CLI-only access guard disabled, allowing access via HTTP after installation. This exposes video viewer statistics, including IP addresses, session IDs, and user agents, to unauthenticated visitors. The script queries VideoStatistic::getLastStatistics() and outputs the result using var dump(). The VideoStatistic object contains viewer IP addresses (ip), session IDs (session id), user agents (user agent), user IDs (users id), and JSON metadata. Verbose error reporting is enabled, potentially revealing internal filesystem paths. The API endpoint ''/install/test.php'' is vulnerable, accepting the videos id variable.

Recommendations Uncomment the CLI guard at install/test.php:6 to restore the intended access restriction.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-35449

GHSA-HG8Q-8WQR-35XX

Affected Products

Avideo

References · 6

• 🔥 https://github.com/WWBN/AVideo/security/advisories/GHSA-hg8q-8wqr-35xx · Exploit
• https://osv.dev/vulnerability/GHSA-hg8q-8wqr-35xx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35449 · Security Note
• https://github.com/WWBN/AVideo · Note
• https://reddit.com/r/VulnMatter/comments/1sdyq51/resumen_diario_de_vulnerabilidades_06042026 · Reddit Post
• https://twitter.com/CVEnew/status/2041282863849783574 · Twitter Post