PT-2026-30713 · Wwbn · Avideo

Adrgs · Published 2026-04-06 · Updated 2026-04-06 · CVE-2026-35180

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions WWBN AVideo versions 26.0 and prior

Description WWBN AVideo, an open source video platform, has an issue in versions 26.0 and prior where the site customization endpoint at admin/customize settings nativeUpdate.json.php does not validate CSRF tokens. This allows a cross-origin POST request to overwrite the platform's logo with attacker-controlled content, as uploaded logo files are written to disk before the ORM's domain-based security check is performed. The SameSite=None cookie policy exacerbates this issue.

Recommendations Update to a version later than 26.0.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-35180

Affected Products

Avideo

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-35180 · Security Note
• https://github.com/WWBN/AVideo/security/advisories/GHSA-5572-2jgx-fc7c · Note
• https://twitter.com/infoflowcloud/status/2041252496237039821 · Twitter Post
• https://twitter.com/CVEnew/status/2041250723594137922 · Twitter Post